Subject: Wall Street Journal: DNS is not secure

From: [email-masked]
Date: Tue, 30 Jan 2001 08:40:32 -0500

Researchers Find Software Flaw
Giving Hackers Key to Web Sites

By TED BRIDIS 
Staff Reporter of THE WALL STREET JOURNAL

WASHINGTON -- Computer experts discovered a flaw in widely used
software that could let hackers hijack corporate and government Web
sites and steal sensitive e-mail.

The flaw in software that controls most of the world's Internet traffic was
quickly deemed a "critical" threat. It affects a popular software known as
BIND (Berkeley Internet Name Domain) that operates the Internet's
equivalent of global telephone directories. Experts warned that hackers
could change or delete entries in those directories at their whim, reroute
Internet traffic or shut down Web sites.

Researchers at the federally funded Coordination Center -- formerly
known as the computer emergency response team -- said the flaw
"threatens the Internet's integrity" because the BIND software is "arguably
the Internet's single most important software package." The federal
government also issued urgent warnings Monday to its civilian agencies.

 World-Wide Bug

Network Associates discovers a big flaw in Internet software.

The software bug allows hackers to rewrite the Internet's equivalent
of telephone directories, called "domain-name servers." 

Any "calls" by Internet surfers made to an affected corporation
would go unanswered or, at worst, be redirected to Web sites
controlled by the hackers. They also could intercept and reroute
e-mail sent to people at that site. 

The flaw affects the latest version of so-called BIND software
created by the Internet Software Consortium for Unix and Linux
computers used by companies. BIND is arguably the Internet's
single most important software package and the flaw threatens the
Internet's integrity, say experts. 

There haven't been any reports that hackers have exploited the flaw,
but experts say tools to do so probably will start appearing on
underground Web sites within days. 

"This is among the most serious vulnerabilities to affect the Internet,"
said Shawn Hernan, the center's team leader for researching computer
vulnerabilities. "Web sites can be taken over, mail can be rerouted and
files can go where you don't expect them to go."

Consumers should watch for unexpected behavior at Web sites or for
undelivered e-mail, since those might indicate activity. Experts warned, for
example, that hackers could quietly redirect visitors from a bank's Web
site to a mock-up that they control to steal passwords and account
numbers.

Major corporations and Internet providers, which typically operate name
servers, were urged to quickly upgrade their software, which could take
from a few minutes to about one hour. Consumers can contact their
Internet-service providers to ensure repairs have been made, especially if
they suspect trouble.

It is impossible to say precisely how many specialized directory computers,
called "domain name servers," are at risk, though experts said hundreds of
thousands need to be fixed by installing the updated software. Nearly
every Web site relies on name servers, which correlate easy-to-remember
Web addresses to the numerical Internet addresses that Web servers
actually recognize.

Name servers can't be hidden or disguised because Internet browsers must
know how to communicate with them to retrieve the latest address
information.

"There's nothing you can do really as a consumer," said Weld Pond,
manager of research and development at @stake, a computer-security firm
in Cambridge, Mass. "Be more suspicious where you're going, be a little
more vigilant."

All 13 of the Internet's most important directory computers, the "root
servers" that direct the flow of the world's data traffic, were vulnerable
until they were repaired quietly earlier this month, weeks before Monday's
announcement.

"It's not an exaggeration to say you could have turned off name resolution
for sections of the Internet; to the average user that would mean no more
Web, no more e-mail, no more Napster," said Jim Magdych, a security
manager at Network Associates Inc., which discovered the flaw.

There were no reports that hackers have yet exploited the bug, but experts
expect tools to start appearing on underground Web sites within days. In
one sense, Monday's disclosure was the start of a race between those
trying to exploit the software flaw and companies that need to repair their
computers.

"Once the tools start showing up, then the 'script-kiddies' can use them,"
said David Conrad, chief technology officer of Nominum Inc., a contractor
to the Internet Software Consortium, which distributes BIND software. "It
wouldn't require any knowledge, just a canned program that somebody
with knowledge had actually written." Mr. Conrad's company helped write
BIND's latest version, which isn't affected by the flaw. (Script-kiddies are
unsophisticated hackers who rely on malicious tools written by others with
more computer skills.)

Write to Ted Bridis at [email-masked]

---

From: "Rahmat M. Samik-Ibrahim" <[email-masked]>
Date: Wed, 31 Jan 2001 19:37:20 +0700

> sites and steal sensitive e-mail.

Instead of WSJ, you might want to refer to 
  http://www.cert.org/advisories/CA-2001-02.html
  http://www.isc.org/products/BIND/bind-security.html

Anyway, I have spend the whole day to fix zones, since
the current BIND does not like "TXT RR" as it used 
to be :-(.

regards,

-- 
Rahmat M. Samik-Ibrahim - VLSM-TJT - http://rms46.vlsm.org
---- Gong Xi Fa Cai ----- Hong Bao Na Lai ----------------