Reviewing 2008's Most Critical DNS Security Hole

VIP LOUNGE

CLOUD LOGIN

You are here: News > News > Reviewing 2008's Most Critical DNS Security Hole

» IT Security NEWS

» 23 May 2009

Reviewing 2008's Most Critical DNS Security Hole

Last year, a coalition of hackers from Europe and the USA developed a rogue Certification Authority (CA) by simply using the computing power of more than 200 PlayStation 3 consoles and spending a mere $700 dollars to do so. This fake CA acts and operates just like a regular CA that permits the production of certificates trusted by all modern browsers and a large amount of users.

The little demonstration in 2008 showed how easy and relatively cheap it is for hackers to penetrate through modern browsers that depend on trusting safe resources for their security. This method in exploiting the CA security hole also allows hackers to do phishing expeditions that are virtually undetectable.

According to Dan Kaminsky (the Director of Penetration Testing and security researcher for IOActive), combining fake CA with a DNS attack can create serious repercussions to overall Internet security. He also adds that there are no direct solutions to the vulnerability until actual CAs switch from the outdated MD5 format to a safer and more secure algorithm like SHA-1. In this front, security experts have been conducting studies and planning major changes to fix this CA design flaw.

Security researchers used to think that it was difficult to exterminate DNS records, but Kaminsky begged to differ, thinking of the process as a foot race where the bad guy (hackers) and good guy (end users) outdo each other in getting a secret number transaction ID. Even though you can get there first, you can't reach your destination without first acquiring the secret number.

In order for an attacker to exploit the MD5 design flaw and deliver harmful little packages that a prospective victim will willingly accept, he merely needs to organize the number of the sender port and the identifier of the sequence (TXID). From there, he can send a bogus DNS response with a fake IP address to some website being perused by the user.

The idea here is to trick a user into visiting a malware-infested website by doing a collision attack on the MD5 algorithm and disguising the site as a safe and trusted one by generating a fake CA. Afterwards, the harmful page will do its thing, inserting damaging code into a computer system without the user knowing any better.

In any case, the point of 2008's little exercise in creating fake CAs, exploiting MD5s, and launching DNS attacks is to demonstrate that any security methods available on the Internet nowadays can be defeated by merely taking control of DNS. Security experts should take a closer look into fixing this hole lest it becomes the newest approach to hacking and cyber crime.