DNS Security Still a Concern
Administrators have made improvements in the security of the Domain Name System
during the last year, but DNS complexity and a lack of resources have resulted
in major security gaps being left in the system that underlies almost all Internet
traffic, according to a recent survey of DNS servers.
One of the most glaring gaps is that 25 percent of servers have not been patched
for the DNS
vulnerability announced earlier this year by Dan Kaminski, which could allow
cache poisoning. The fix issued for this flaw in the DNS protocol enables port
randomization for queries. A major push by vendors was conducted over the summer
to raise awareness and encourage patching.
"On the one hand, we should be impressed that we were able to get that
many servers patched in that time," said Cricket Liu, vice president of
architecture of Infoblox Inc., which conducted the study. "On the other
hand, there is a lot left to do."
"This is a profound vulnerability," said Paul Parisi, chief technology
officer of DNSStuff, which performs security checks on DNS servers. Meanwhile,
45 percent of administrators queried said they do not have the resources to
fix the problem, and 30 percent said they do not know enough about DNS.
The other news is that most DNS servers are running up-to-date software with
fewer vulnerabilities and most security trends are improving, if slowly.
"That means people are paying attention," Liu said.
DNS maps domain names to IP addresses, directing Internet inquiries to the
appropriate location. Name servers do this resolution for essentially every
Internet request. Protecting the system from vulnerabilities that could allow
addresses to be spoofed, traffic to be hijacked or servers to be subject to
denial-of-service attacks is critical to the health and availability of the
The survey is the fourth annual study of domain name servers on the Internet
conducted by Infoblox and the Measurement Factory. It is based on a sample of
5 percent of the IPv4 address space, which is scanned for name servers. The
servers are then queried for information in their software and configuration.
The sample produced an estimate of 11.9 million name servers on the public-facing
Internet, which is consistent with last year's estimate of 11.7 million
servers, said Liu.
The sweep showed that 90 percent of the servers running the Berkeley Internet
Name Domain (BIND), the most common DNS software, are running recent versions
of BIND 9, about the same percentage as last year. The latest versions of BIND
are the most secure, Liu said. "The earlier versions all have widely known,
easily exploited vulnerabilities."
At the same time, there has been a dramatic falloff in the use of the unsecure
Microsoft DNS Server, which has dropped from 2.7 percent of the population studied
last year to just .17 percent this year.
However, other improvements are moving slowly. The use of the Sender Policy
Framework, which verifies that e-mail is being sent from an appropriate address,
has increased from 12.6 percent last year to 16.7 percent this year. Just how
good that number is depends on the volume of e-mail messages those domains are
responsible for, Liu said.
"It may be quite good," he said. "We don't know. But
I am pleased with that number."
He is less pleased with the adoption rate for DNSSec, a security protocol that
allows DNS queries and answers to be digitally signed and authenticated. Only
.002 percent of the zones queried support DNSSec, a statistically insignificant
"We had hoped there would be more interest in DNSSec," Liu said.
"There are a number of reasons" for the lack of adoption. "It
is administratively cumbersome to generate and manage keys and sign queries.
And some servers and management products don't support it. Education also
is a part of it."
The federal government's mandate to begin using DNSSec in the .gov domain
by the end of next year could help tip the Internet toward a critical mass,
he said. "The more zones out there that are signed, the more valuable
it will be."
Also disappointing is that 40 percent of Internet name servers still allow
open recursive queries, which makes them vulnerable to cache poisoning and denial
of service attacks, and 30 percent allow zone transfers to arbitrary requestors,
which lets DNS zone data be copied from one DNS server to another. This also
leaves them open to denial-of-service attacks.
Administrators should take advantage of management tools to help discover,
update and manage their DNS infrastructure, Liu and Parisi said. Software should
be updated and patched to protect them against exploits for known vulnerabilities.
William Jackson is the senior writer for Government Computer News (GCN.com).