Look up in anger
Published: 02 May 2006 14:00 BST
What would you do if www.google.com came back 'Not found'? Or if your bookmark to your banking site led to the perfect fake? A report from Cornell University says that such scenarios are not just possible but plausible, thanks to weaknesses in the way Internet names are controlled.
Invisible to most and completely unknown to many, the DNS system maps out the translations that take the www.zdnet.co.uk we understand and turn it into the 62.108.136.20 the machines work with. If DNS returns a wrong translation, the names we trust can be silently hijacked to lead to malicious sites. Vandals can turn services off; criminals can create the ultimate phish.
It's no secret that the DNS system responsible is imperfect. What the report points out, however, is the extent of the problem. Each name depends on an average of 46 servers, and compromising just two servers will hijack 30 percent of names. Two out of 46 is just five percent, yet 17 percent of the 167,000 servers that were surveyed had known vulnerabilities. In other words, the odds heavily favour the knowledgeable attacker.
Fixing this is not trivial, but it is very achievable. The first stage would be to patch all the DNS servers with known vulnerabilities; the next would be to create a chain of trust throughout the hierarchy by a technology such as DNSSEC. The alternative is to carry on ignoring the problem until we wake up to the costs and disruption of a successful exploit. That's tombstone regulation, inevitably expressed through draconian laws and ever more official control by people who don't know what they're doing -- but are determined to do it.
We have no shortage of people claiming an interest in regulating the Internet -- look at the heat and noise generated by powerful people over subjects such as the .XXX domain and the straw man of cyberterrorism. True governance and true responsibility will come from soberly considering the true risks to our information infrastructure, prioritising them according to cost, risk and benefit, and making sure everyone involved knows what to do. Then, at last, things will start to look up.
Did you find this article useful?
14 out of 26 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
