DNS inventor tackles flaw

The inventor of the internet’s addressing system is working towards new measures designed to plug recently revealed security flaws.

The original designer of the internet's Domain Name System (DNS) is in the UK to discuss industry responses to security flaws recently uncovered in its handling of internet protocol (IP) addresses.

The DNS vulnerability, first proven by researcher Dan Kamsinky in July 2008, highlighted how criminals can potentially redirect unsuspecting victims to fake websites, even when they type in a genuine web address.

The flaw has since been exploited to poison the servers that translate domain names into internet protocol (IP) addresses, giving malware another attack vector to infect user PCs with malicious code or intercept and edit email.

But Dr Paul Mockapetris - who is now chairman and chief scientist at IP address infrastructure software developer, Nominum - told IT PRO work to tackle the flaw was reaching well beyond the scope of patching the flaw itself.

"Our focus has moved onto additional security measures beyond DNS," said Mockapetris. "It was never meant to be the only security mechanism for naming data on the internet, but was intended for additional security measures to be added to it later."

He said the time was right for the introduction of digital signature technology, along the lines of the work being carried out by the European Network and Information Security Agency (ENISA) to implement new standards, like Domain Name System Security Extensions (DNSSEC). Several European and US Country Code Top Level Domain Registries have already adopted the use of the protocol's origin authentication capability.

"In the DNSSEC era of the future, we will look to digital signatures to distribute the reputation of a web address into the filters used by email and virus filters to remove spam and block spam sites," he added.

"And we're seeing the work of ENISA and some political movement towards making this part of the expectation of users who want to have a trusted experience on a website."

Mockapetris will give a keynote presentation in Brussels later this week at the ENISA "Resilience of Public e-Communication Networks" workshop. "Half of all DNS systems are not yet using DNSSEC," he said. "So I'll be urging that we work on interfacing such technologies to as many internet applications as possible."

Click here to read how ENISA is trying to protect European networks, and here for background on the DNS flaw.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

Ryuk behind a third of all ransomware attacks in 2020
Security

Ryuk behind a third of all ransomware attacks in 2020

29 Oct 2020
REvil hacking group says it has made more than $100m in a year
Security

REvil hacking group says it has made more than $100m in a year

29 Oct 2020
36 billion personal records exposed by hacks in 2020 so far
Security

36 billion personal records exposed by hacks in 2020 so far

29 Oct 2020
Trump website defaced in second successive cyber breach
Security

Trump website defaced in second successive cyber breach

28 Oct 2020

Most Popular

Do smart devices make us less intelligent?
artificial intelligence (AI)

Do smart devices make us less intelligent?

19 Oct 2020
Politicians need to stop talking about technology
Policy & legislation

Politicians need to stop talking about technology

21 Oct 2020
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020