Technology news and Jobs 
Information Technology News One in four domain name servers wide open to attack
Information Technology News One in four domain name servers wide open to attack | One in four domain name servers wide open to attack |
|
| by Stuart Corner | |
| Friday, 14 November 2008 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
The survey also found that almost half of all domain name servers are vulnerable to distributed denial of service attacks. This just days after Arbor Networks released its annual Worldwide Infrastructure Security Report which found the size of DDoS attacks far outstripping bandwidth growth in the network. Arbor reported that the largest attack - a 40Gbps flood mounted as an extortion attempt - was ended only by the target organisation paying money to the perpetrators. Liu added that "Even if an enterprise has gone to the trouble of patching against the Kaminsky vulnerability, there are many other aspects of configuration, like recursion and open zone transfers, that should also be secured. "If not, organisations are essentially locking their door to their house, but leaving the windows wide open. Organisations clearly need to pay more attention to configurations and deployment architectures that are leaving their DNS infrastructures vulnerable to attacks and outages." Infoblox says its survey was based on a sample that included five percent of the IPv4 address space, nearly 80 million addresses. It found that: - One in four DNS servers does not perform source port randomisation - the basic 'patch' for the Kaminsky vulnerability; - More than 40 percent of Internet name servers allow recursive queries. "[These are] a danger both to themselves and others – they are vulnerable to cache poisoning and distributed denial of service attacks," Infoblox claims. - Thirty percent of DNS servers surveyed allow zone transfers to arbitrary requestors, leaving them easy targets for denial-of-service attacks. The long term solution to the Kaminsky vulnerability, and a host of other threats to DNS, is DNSSEC, but the survey found that only .002 percent of DNS zones tested support DNSSEC. "Administrators have not been convinced of its importance - perhaps intimidated by its complexity - but new mandates could mean a significant change in the near future," Infoblox said. |
Tags
| < Next story in category | Previous story in the category > |
|---|
