[ISN] DNS Trouble Knocks NSA off Internet

From: InfoSec News (alerts@private)
Date: Fri May 16 2008 - 01:05:19 PDT


By Robert McMillan
IDG News Service
May 15, 2008

A server problem at the U.S. National Security Agency has knocked the 
secretive intelligence agency off the Internet.

The nsa.gov Web site was unresponsive at 7 a.m. Pacific time Thursday 
and continued to be unavailable throughout the morning for Internet 

The problem was resolved at around 11 a.m. Pacific time, according to 
Web site measurement company Netcraft.

The Web site was unreachable because of a problem with the NSA's DNS 
(Domain Name System) servers, said Danny McPherson, chief research 
officer with Arbor Networks. DNS servers are used to translate things 
like the Web addresses typed into machine-readable Internet Protocol 
addresses that computers use to find each other on the Internet.

The agency's two authoritative DNS servers were unreachable Thursday 
morning, McPherson said.

Because this DNS information is sometimes cached by Internet service 
providers, the NSA would still be temporarily reachable by some users, 
but unless the problem is fixed, NSA servers will be knocked completely 
off-line. That means that e-mail sent to the agency will not be 
delivered, and in some cases, e-mail being sent by the NSA would not get 

"We are aware of the situation and our techs are working on it," a NSA 
spokeswoman said at 9:45 a.m. PT. She declined to identify herself.

A similar DNS problem knocked Youtube.com off-line in early May.

There are three possible reasons the DNS server was knocked off-line, 
McPherson said. "It's either an internal routing problem of some sort on 
their side or they've messed up some firewall or ACL [access control 
list] policy," he said. "Or they've taken their servers off-line because 
something happened."

That "something else" could be a technical glitch or a hacking incident, 
McPherson said.

In fact, the NSA has made some basic security mistakes with its DNS 
servers, according to McPherson. The NSA should have hosted its two 
authoritative DNS servers on different machines, so that if a technical 
glitch knocked one of the servers off-line, the other would still be 
reachable. Compounding problems is the fact that the DNS servers are 
hosted on a machine that is also being used as a Web server for the 
NSA's National Computer Security Center.

"Say there was some Apache or Windows vulnerability and hackers 
controlled that server, they would now own the DNS server for nsa.gov," 
he said. "That really surprised me. I wouldn't think that these guys 
would do something like that."

The NSA is responsible for analysis of foreign communications, but it is 
also charged with helping protect the U.S. government against cyber 
attacks, so the outage is an embarrassment for the agency.

"I am certain that someone's going to send an e-mail at some point 
that's not going to get through," McPherson said. "If it's related to 
national security and it's not getting through, then as a U.S. citizen, 
that concerns me."

(Anders Lotsson with Computer Sweden contributed to this report.)

Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Fri May 16 2008 - 01:19:42 PDT