CZ.NIC Warns Against Increased DNS System Attack Risk

Prague, 8th August - Potential misuse of the DNS domain system is much more real from yesterday. The international hacker conference BlackHat USA 2008 ending on Thursday has brought additional details to the DNS security gap and new options for its exploiting. A significant contribution to solution of this problem could be the DNSSEC technology implementation in DNS. This technology is currently fully operational in five countries of the world. In the Czech Republic the CZ.NIC association has been testing this technology since this year’s April, with full operation launch in .CZ and ENUM domains scheduled for September. The CZ.NIC association recommends all internet service providers to implement this service.

The DNS system security bug allows attackers to forge any numeric address of any domain name, redirecting its users to a fake website. This threat therefore applies to the vast majority of internet services such as on-line banking, media and e-shops. Besides, attackers can wiretap on e-mails and phone calls routed through the internet.

This DNS attack principle had been known before. However, the attack method published at the conference significantly simplifies the entire process, considerably increasing the likeliness of successful attack.

“This is one of the most critical errors in the DNS protocol. DNS is one of the cornerstones of the today’s Internet, meaning that the impact of this error should not be underestimated. The conference has proved that a server without necessary updates can be attacked in few seconds. If those who manage DNS servers have not updated their systems, it is the high time now for them to do so,” warned Ondřej Surý, Technical Director of the CZ.NIC association, adding: “The CZ.NIC association is working on increasing the DNS service security, preparing implementation of the DNSSEC technology in .CZ domains. In September when full DNSSEC operation starts, the Czech Republic will join the first countries of the world that already have such security level available.”

More information about the actual attack can be found at the website of Dan Kaminsky www.doxpara.com and the website of the BlackHat conference BlackHat. A warning about the necessary protection of DNS has also been published by the CZ.NIC association at www.nic.cz or at the association’s blog blogu. A technical comment is available here too, describing DNS server attack options and possible misuse of information stored in these servers here.

About the DNSSEC Technology

DNSSEC is an extension to the DNS system, increasing the domain name service security. The principle of DNS is the translation of name-based internet addresses such as www.nic.cz or www.dobradomena.cz to numeric addresses that can be understood by computers and used to display specific web pages, send e-mail, make phone calls over the internet and provide other common internet services. DNSSEC enhances the security when using DNS by preventing fake, altered or incomplete domain name data. As the administrator of the .CZ and ENUM domain registry, the CZ.NIC association is preparing deployment of this security technology for holders of the above domains and Czech internet users in September 2008. More information is available at www.nic.cz/dnssec/.