DNSSEC Industry Coalition Symposium Is Announced

The DNSSEC Industry Coalition Symposium is announced to be held June 11-12, 2009, in Washington, DC in collaboration with Google, Nominum, Inc. and the Internet Corporation for Assigned Names and Numbers (ICANN).

The purpose will be to discuss and identify potential and perceived issues with the Domain Name System (DNS) and DNSSEC deployment due to signing the DNS root zone. During the first part of the symposium, participants will present issues along with any proposed solutions. During the second part, recommended solutions or next steps for reaching solutions will be discussed.

The Coalition Symposium participants are from the global community of DNSSEC software vendors, root operators, ISPs and other resolver operators, DNS security community, and others. The results from discussions will be published in a Coalition Report and will be available directly after the symposium.


Source: earthtimes.org/articles/show/dnssec-industry-coalition-symposium-is-announced,833592.shtml

Internet users trying to reach Google Morocco were, for a few hours, sent to a Web site unaffiliated with Google

Google says that while visitors to its Moroccan Web site may have been misdirected over the weekend, its Web site was not hacked. On Saturday, a report on ArabCrunch said that Google Morocco had been hacked, based on a tweet from Habib Haddad, founder of the Google-powered Arabic search engine Yamli.

A screen shot posted by Haddad (above) suggests that Google's Moroccan Web site was defaced. But according to a Google spokesperson, "Google services in Morocco are not hacked. Since Friday PST, some users visiting "google.com.ma" were redirected to a different Web site. We're in touch with the appropriate hosting service to help investigate the issue."

What appears to have happened is that some domain information associated with Google Morocco was altered, allowing the attacker to send Internet users seeking Google Morocco to an alternate site. The distinction matters to Google because the security vulnerability that permitted the hijacking would have to reside in software or hardware operated by a third party rather than in a machine operated by Google.

As a practical result of the attack, Internet users trying to reach Google Morocco were, for a few hours, sent to a Web site unaffiliated with Google. Service has been restored.
Security researchers, such as Dan Kaminsky of IOActive, have been warning that infrastructure attacks represent a growing threat to Web sites. "The reality is the bad guys are out there, and they're learning," Kaminsky wrote in a blog post in March. "Just as attackers moved from servers to clients, some are moving from compromising a single client to compromising every client behind vulnerable infrastructure."

Other recent DNS attacks have reportedly affected a domain registrar serving Puerto Rico and a bank in Brazil. Kaminsky and other security researchers have been supporting the move to DNSSEC, an extension to the DNS system that allows domain information to be authenticated.


Source: "Google Morocco Not Hacked, Company Insists", Thomas Claburn, Information Week, Retrived on 05/11/2009 from informationweek.com/news/internet/google/showArticle.jhtml?articleID=217400310

House Energy and Commerce Subcommittee on Communications, Technology, and the Internet Hearing

"Often, the security industry, through hard work, coordination, knowledge and frequently, pure luck, are able to mitigate the effects before end users notice them. In most cases, these attacks never come to public notice. However, just a few minutes of effort with Google, searching for the terms "DNS and DDoS", and "cache poisoning", and "keystroke logging" will bring thousands of links to reports of successful breaches of Internet defenses. I'll focus on some events that have occurred or have been identified publicly in the last month.

In the first attack, on April 1st, 2009, Register.com, one of the major Internet domain name registrars, was attacked by the use of a DNS DDoS. In this attack, the attackers caused tens of thousands of compromised computers to flood the DNS or directory servers of the victim with bogus DNS requests, effectively rendering the directory servers unusable. In this particular case, hundreds of thousands of organizations became unreachable because Register.com provided the DNS service for their domains. This attack lasted a number of hours, but the effects lingered for a few days.

A second event occurred on April 12th that is far more insidious for average Internet users. The DNS servers of a large Brazilian ISP, Virtua, were compromised and their cache, or their local temporarily stored domain name and address directory, was "poisoned". The entry for one of Brazil's major banks, Bradesco, was modified by re-directing users to a fake website that was an exact copy of the Bradesco site, but was controlled by cybercriminals. This poisoned entry remained in place for five hours before Virtua and Bradesco noticed the problem and corrected it. According to an official statement from Bradesco, approximately "only 1% of their customers" were affected and potentially re-directed to this malicious site. Unfortunately, 1% of their customers are almost 150,000 individuals and this represents potentially huge monetary losses

Similar cache poisoning events have been occurring for years, and the only complete defense is the implementation of the DNSSEC protocol. However, absent significant effort and support, this solution is unlikely to be available to the general public until 2011 at the earliest."

Read full article

Source: “House Energy and Commerce Subcommittee on Communications, Technology, and the Internet Hearing”, TMCnews, Retrieved on 05/05/2009 from tmcnet.com/usubmit/2009/05/04/4162903.htm

Cybersecurity incentives, not mandates, needed

The U.S. Congress should look to provide incentives for private businesses to adopt stronger cybersecurity practices instead of creating new mandates, one information security expert told a congressional subcommittee Friday.

One role for government would be to continue to encourage the development of DNS Security Extensions, or DNSSec, a package of security fixes for the Internet Domain Name System, said Dan Kaminsky, director of penetration testing at cybersecurity vendor IOActive.

DNSSec would allow organizations to better trust Internet traffic coming from the outside, he said. "It will take some work; it will take a lot of work," Kaminsky added.

Source: "Expert: Cybersecurity incentives, not mandates, needed", Grant Gross, Retrieved on 05/02/2009 form webwereld.nl/internationaal-nieuws/57708/expert--cybersecurity-incentives--not-mandates--needed.html