Internet bug fix spawns backlash from hackers

Hackers are a skeptical bunch, but that doesn't bother Dan Kaminsky, who got a lot of flack from his colleagues in the security research community after claiming to have discovered a critical bug in the Internet's infrastructure.

Kaminsky made headlines on Tuesday by talking about a major flaw in the DNS, used to connect computers to each other on the Internet. In late March he grouped together 16 companies that make DNS software - companies like Microsoft, Cisco and Sun - and talked them into fixing the problem and jointly releasing patches for it.

Hear Dan Kaminsky's explanation of the flaw, in our Newsmaker of the Week podcast. 

But some of Kaminsky's peers were unimpressed. That's because he violated one of the cardinal rules of disclosure: publicizing a flaw without providing the technical details to verify his finding. On Wednesday he took things a step further on his blog, asking hackers to avoid researching the problem until next month, when he plans to release more information about it at the Black Hat security conference.

The flaw appears to be a serious one that could be exploited in what's called a "cache poisoning attack." These attacks hack the DNS system, using it to redirect victims to malicious Web sites without their knowledge. They have been known about for years but can be hard to pull off. But Kaminsky claims to have found a very effective way of launching such an attack, thanks to a vulnerability in the design of the DNS protocol itself.

On Tuesday, however, Kaminsky held back from disclosing the technical details of his finding.

He said he wanted to go public with the issue to put pressure on corporate IT staff and Internet service providers to update their DNS software, while at the same time keeping the bad guys in the dark about the precise nature of the problem. A full public disclosure of the technical details would make the Internet unsafe, he said in an interview Wednesday. "Right now, none of this stuff needs to go public."

He quickly received a skeptical reaction from Matasano Security researcher Thomas Ptacek, who blogged that Kaminsky's cache poisoning attack is merely one of many disclosures underlining the same well-known problem with DNS -- that it does not do a good enough job in creating random numbers to create unique "session ID" strings when communicating with other computers on the Internet.

"The bug in DNS is that it has a 16-bit session ID," he said via an e-mail Wednesday. "You can't deploy a new Web app with less than 128-bit session IDs. We've known about that fundamental problem since the '90s."

"Here comes the onslaught of interviews and media explosion for another overhyped bug by Dan Kaminsky," wrote a jaded (and anonymous) poster to the Matasano blog.

Over at the SANS Internet Storm Center, a highly respected security blog, one blogger speculated that Kaminsky's bug had actually been disclosed three years earlier.

Kaminsky, who is director of penetration testing with security vendor IOActive, said that he was "vaguely surprised" by some of the negative reaction, but that this kind of skepticism was vital to the hacker community. "I'm breaking the rules," he admitted. "There's not enough information in the advisory to figure out the attack and I'm bragging about it."

The IDG News Service is a Network World affiliate.