http://www.networkworld.com/news/2006/100906-dns-server.html
By Carolyn Duffy Marsan
Network World
10/09/06
More than half of the Internets name servers are configured incorrectly,
leaving networks vulnerable to pharming attacks and enabling servers to
be used in attacks that can wipe out DNS infrastructure.
This is the key finding of a survey of the Internets domain name servers
released Monday. The Measurement Factory conducted the survey for
Infoblox, which sells DNS appliances.
Overall, the 2006 DNS Report Card assigned a grade of D+ for DNS
security. This is the second annual survey conducted by The Measurement
Factory about the state of the global DNS.
We saw an increase in the pace and severity of attacks and outages
resulting from bad configurations in the DNS infrastructure,? says Rick
Kagan, vice president of marketing for Infoblox.
The surveys main finding was that more than half of the Internets name
servers allow recursive name services. This is a form of name resolution
that often requires a name server to relay requests to other name
servers.
Infoblox says that allowing recursive name services leaves networks
vulnerable to cache poisoning attacks, in which users are redirected to
a different Web site often for the purpose of capturing personal
information.
"There is no need for servers to support recursive name services,? Kagan
says. "The problem is that BIND 9 enables recursive name services by
defaultThis is a bad vulnerability. It has been exploited; there are
public examples where that has happened. But its easy to fix and people
should address it.?
Another DNS configuration problem that the survey found is that 29% of
DNS servers allow zone transfers to arbitrary requesters. Zone transfers
copy DNS data from one server to another, and leave servers open to
denial-of-service attacks.
The surveys other findings were:
* The number of DNS servers connected to the Internet rose 20% in the
last year to 9 million. Most of that growth was in Europe and Asia,
with many new DNS servers embedded in cable modems and phone gateways.
* The number of DNS servers running the latest open source software BIND
9 from Internet Software Consortium rather than the older BIND 8 rose
from 58% in 2005 to 61% in 2006.
* Only two out of every 1,000 DNS servers support IPv6, showing the slow
pace at which this upgrade to the Internets main communications
protocol is being deployed.
* Virtually no one is using DNSSEC, the proposed standard for
authenticating DNS data. DNSSEC is supported on one out of every
100,000 DNS servers.
All contents copyright 1995-2006 Network World, Inc.
_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org
This archive was generated by hypermail 2.1.3 : Tue Oct 10 2006 - 22:34:01 PDT