.: GAFNO.com - Hot World News Blog :.

Speaking before a packed audience, researcher Dan Kaminsky explained the urgency in having everyone patch their systems: virtually everything we do on the Internet involves a Domain Name System request and therefore is vulnerable.

Expectations ran running high before Wednesday morning as Kaminsky, director of Penetration Testing for IOActive, revealed little about his DNS vulnerability. That didn’t stop others from trying to figure it out. That actually helped Kaminsky; he was able to skip the what and go directly to the why.

Security researchers always thought it was hard to poison DNS records but Kaminsky said to think of the process as a race, with a good guy and bad guy each trying to get a secret number transaction ID. “You can get there first,” he said, “but you can’t cross finish line unless you have the secret number.”

The question is why would someone bother? Well, Kaminsky talked about embedded DNS is in our lives. Kaminsky said there are three ages in computer hacking. The first was attacking servers (for example FTP and Telnet). The second was attacking the browsers (for example Javascript and ActiveX). We’re now about to enter the third age where attacking Everything Else is possible.

Well, Kaminsky talked about embedded DNS is in our lives. We know that if we type a name.com into a browser, the DNS resolves it to its numerical address. But what we don’t realize is that same process occurs when we send e-mail or when we log onto a Web site. These also require DNS lookup.

Kaminsky then detailed how various security methods on the Web can be defeated if one owns the DNS. For example, if a site wants to established a Trust Authority Certificate, the Certificate Authorities because they use e-mail to confirm the idenity of the requester. He also said that its possible to poison Google Analytics and even Google AdSense, which also rely on DNS lookup.

Prior to the patch the bad guy had a 1 in 65,000 chance of getting it because the transaction ID is based in part on the port number used. With the patch the chances increase to 2,147,483,648 to 1. Kaminsky said it’s not perfect, but it’s a good enough start.

Click here for full coverage of Black Hat 2008.