News

DNS Security Still a Concern

• By William Jackson
• 11/10/2008

One of the most glaring gaps is that 25 percent of servers have not been patched for the DNS vulnerability announced earlier this year by Dan Kaminski, which could allow cache poisoning. The fix issued for this flaw in the DNS protocol enables port randomization for queries. A major push by vendors was conducted over the summer to raise awareness and encourage patching.

"On the one hand, we should be impressed that we were able to get that many servers patched in that time," said Cricket Liu, vice president of architecture of Infoblox Inc., which conducted the study. "On the other hand, there is a lot left to do."

"This is a profound vulnerability," said Paul Parisi, chief technology officer of DNSStuff, which performs security checks on DNS servers. Meanwhile, 45 percent of administrators queried said they do not have the resources to fix the problem, and 30 percent said they do not know enough about DNS.

The other news is that most DNS servers are running up-to-date software with fewer vulnerabilities and most security trends are improving, if slowly.

"That means people are paying attention," Liu said.

DNS maps domain names to IP addresses, directing Internet inquiries to the appropriate location. Name servers do this resolution for essentially every Internet request. Protecting the system from vulnerabilities that could allow addresses to be spoofed, traffic to be hijacked or servers to be subject to denial-of-service attacks is critical to the health and availability of the Internet.

The survey is the fourth annual study of domain name servers on the Internet conducted by Infoblox and the Measurement Factory. It is based on a sample of 5 percent of the IPv4 address space, which is scanned for name servers. The servers are then queried for information in their software and configuration. The sample produced an estimate of 11.9 million name servers on the public-facing Internet, which is consistent with last year's estimate of 11.7 million servers, said Liu.

The sweep showed that 90 percent of the servers running the Berkeley Internet Name Domain (BIND), the most common DNS software, are running recent versions of BIND 9, about the same percentage as last year. The latest versions of BIND are the most secure, Liu said. "The earlier versions all have widely known, easily exploited vulnerabilities."

At the same time, there has been a dramatic falloff in the use of the unsecure Microsoft DNS Server, which has dropped from 2.7 percent of the population studied last year to just .17 percent this year.

However, other improvements are moving slowly. The use of the Sender Policy Framework, which verifies that e-mail is being sent from an appropriate address, has increased from 12.6 percent last year to 16.7 percent this year. Just how good that number is depends on the volume of e-mail messages those domains are responsible for, Liu said.

"It may be quite good," he said. "We don't know. But I am pleased with that number."

He is less pleased with the adoption rate for DNSSec, a security protocol that allows DNS queries and answers to be digitally signed and authenticated. Only .002 percent of the zones queried support DNSSec, a statistically insignificant amount.

"We had hoped there would be more interest in DNSSec," Liu said. "There are a number of reasons" for the lack of adoption. "It is administratively cumbersome to generate and manage keys and sign queries. And some servers and management products don't support it. Education also is a part of it."

The federal government's mandate to begin using DNSSec in the .gov domain by the end of next year could help tip the Internet toward a critical mass, he said. "The more zones out there that are signed, the more valuable it will be."

Also disappointing is that 40 percent of Internet name servers still allow open recursive queries, which makes them vulnerable to cache poisoning and denial of service attacks, and 30 percent allow zone transfers to arbitrary requestors, which lets DNS zone data be copied from one DNS server to another. This also leaves them open to denial-of-service attacks.

Administrators should take advantage of management tools to help discover, update and manage their DNS infrastructure, Liu and Parisi said. Software should be updated and patched to protect them against exploits for known vulnerabilities.