Dan Kaminsky

Dan Kaminsky is an American security researcher. He is the Chief Scientist of White Ops, a firm specializing in detecting malware activity via JavaScript. He has worked for Cisco, Avaya, and IOActive, where he was the Director of Penetration Testing.[1][2] He is known among computer security experts for his work on DNS cache poisoning, and for showing that the Sony Rootkit had infected at least 568,200 computers[3] and for his talks at the Black Hat Briefings.[2]

This article is about the American computer security researcher. For the American actor and singer born Daniel Kaminsky, see Danny Kaye.
Dan Kaminsky
Kaminsky in 2015
OccupationComputer security researcher
Known forDiscovering the 2008 DNS cache poisoning vulnerability

In June 2010, Kaminsky released Interpolique,[4][5] a beta framework for addressing injection attacks such as SQL injection and cross-site scripting in a manner comfortable to developers.

On June 16, 2010, he was named by ICANN as one of the Trusted Community Representatives for the DNSSEC root.[6]

Flaw in DNS

In July 2008, the CERT Coordination Center announced that Kaminsky had discovered a fundamental flaw in the Domain Name System (DNS) protocol. The flaw could allow attackers to easily perform cache poisoning attacks on most nameservers[7] (djbdns, PowerDNS, MaraDNS, Secure64 and Unbound were not vulnerable).[8] With most Internet-based applications depending on DNS to locate their peers, a wide range of attacks became feasible, including web site impersonation, email interception, and authentication bypass via the "Forgot My Password" feature on many popular websites.

Kaminsky worked with DNS vendors in secret to develop a patch to make exploiting the vulnerability more difficult, releasing it on July 8, 2008.[9] The vulnerability itself has not been fully fixed, as it is a design flaw in DNS itself.[10]

Kaminsky had intended not to publicize details of the attack until 30 days after the release of the patch, but details were leaked on July 21, 2008.[11] The information was quickly pulled down, but not before it had been mirrored by others.[12]

Kaminsky received a substantial amount of mainstream press after disclosing his vulnerability,[13][14] but experienced some backlash from the computer security community for not immediately disclosing his attack.[15]

The actual vulnerability was related to DNS only having 65,536 possible transaction IDs, a number small enough to simply guess given enough opportunities. Dan Bernstein, author of djbdns, had reported this as early as 1999.[16] djbdns dealt with the issue using Source Port Randomization, in which the UDP port was used as a second transaction identifier, thus raising the possible ID count into the billions. Other more popular name server implementations left the issue unresolved due to concerns about performance and stability, as many operating system kernels simply weren't designed to cycle through thousands of network sockets a second. Instead, other implementers assumed that DNS's time to live (TTL) field would limit a guesser to only a few attempts a day.[17]

Kaminsky's attack bypassed this TTL defense by targeting "sibling" names like "83.example.com" instead of "www.example.com" directly. Because the name was unique, it had no entry in the cache, and thus no TTL. But because the name was a sibling, the transaction-ID guessing spoofed response could not only include information for itself, but for the target as well. By using many "sibling" names in a row, he could induce a DNS server to make many requests at once. This provided enough opportunities to guess the transaction ID to successfully spoof a reply in a reasonable amount of time.

To fix this, all major DNS servers implemented Source Port Randomization, as both djbdns and PowerDNS had before. This fix is widely seen as a stopgap measure, as it only makes the attack up to 65,536 times harder. An attacker willing to send billions of packets can still corrupt names. DNSSEC has been proposed as the way to bring cryptographic assurance to results provided by DNS, and Kaminsky has spoken in favor of it.[18]

Sony rootkit

During the Sony BMG CD copy protection scandal, Kaminsky used DNS cache snooping to find out whether or not servers had recently contacted any of the domains accessed by the Sony rootkit. He used this technique to estimate that there were at least 568,200 networks that had computers with the rootkit.[3]

In April 2008, Kaminsky realized a growing practice among ISPs potentially represented a security vulnerability. Various ISPs have experimented with intercepting return messages of non-existent domain names and replacing them with advertising content. This could allow hackers to set up phishing schemes by attacking the server responsible for the advertisements and linking to non-existent subdomains of the targeted websites. Kaminsky demonstrated this process by setting up Rickrolls on Facebook and PayPal.[1][19] While the vulnerability used initially depended in part that Earthlink was using Barefruit to provide its advertising, Kaminsky was able to generalize the vulnerability to attack Verizon by attacking its ad provider, Paxfire.[20]

Kaminsky went public after working with the ad networks in question to eliminate the immediate cross-site scripting vulnerability.[21]

Automated detection of Conficker

On March 27, 2009, Kaminsky discovered that Conficker-infected hosts have a detectable signature when scanned remotely.[22] Signature updates for a number of network scanning applications are now available including NMap[23] and Nessus.[24]

Flaws in Internet X.509 Infrastructure

In 2009, in cooperation with Meredith L. Patterson and Len Sassaman, Kaminsky discovered numerous flaws in the SSL protocol. These include the use of the weak MD2 hash function by Verisign in one of their root certificates and errors in the certificate parsers in a number of Web browsers that allow attackers to successfully request certificates for sites they don't control.[25][26]

Attack by "Zero for 0wned"

On July 28, 2009, Kaminsky, along with several other high-profile security consultants, experienced the publication of their personal email and server data by hackers associated with the "Zero for 0wned" online magazine.[27][28][29] The attack appeared to be designed to coincide with Kaminsky's appearance at the Black Hat Briefings and DEF CON conferences.

gollark: ++exec```luaprint(tostring(1+1))```
gollark: Syntax is wrong.
gollark: Excellent.
gollark: ++exec```luaprint "lua!"```
gollark: ++exec```shelllua```

References
  1. Ryan Singel (2008-04-19). "ISPs' Error Page Ads Let Hackers Hijack Entire Web, Researcher Discloses". Wired. Retrieved 2008-05-19.
  2. Michael S. Mimoso (2008-04-14). "Kaminsky on DNS rebinding attacks, hacking techniques". Search Security. Retrieved 2008-05-19.
  3. Quinn Norton (2005-11-15). "Sony Numbers Add Up to Trouble". Wired. Archived from the original on 2008-04-23. Retrieved 2008-05-19.
  4. "Interpolique Home Page". Archived from the original on 2010-06-18.
  5. "Kaminsky Issues Developer Tool to Kill Injection Bugs".
  6. "TCR Selection 2010".
  7. "CERT Vulnerability Note VU#800113: Multiple DNS implementations vulnerable to cache poisoning". United States Computer Emergency Readiness Team. 2008-07-08. Retrieved 2008-11-27.
  8. "Dan Kaminsky Discovers Fundamental Issue In DNS: Massive Multivendor Patch Released".
  9. "Not a Guessing Game". Circleid.com. 2008-07-14. Retrieved 2013-01-25.
  10. "Patches coming today for DNS vulnerability". Linux.com. Archived from the original on 2009-04-17. Retrieved 2013-01-25.
  11. "Kaminsky's DNS Issue Accidentally Leaked?". Invisible Denizen blog. 2008-07-21. Retrieved 2008-07-30.
  12. "DNS bug leaks by matasano". beezari's LiveJournal. 2008-07-22. Archived from the original on 2008-09-17. Retrieved 2008-07-30.
  13. "news.google.com". news.google.com. Retrieved 2013-01-25.
  14. Lathrop, Daniel; Shukovsky, Paul (2008-08-03). "Seattle security expert helped uncover major design flaw on Internet". Seattle Post-Intelligencer.
  15. Pwnie Award Nominees Archived 2008-07-30 at the Wayback Machine
  16. "DNS forgery". Cr.yp.to. Retrieved 2013-01-25.
  17. "Measures to prevent DNS spoofing". Ds9a.nl. 2006-11-02. Retrieved 2013-01-25.
  18. https://www.blackhat.com/presentations/bh-dc-09/Kaminsky/BlackHat-DC-09-Kaminsky-DNS-Critical-Infrastructure.pdf
  19. McFeters, Nathan (2008-04-21). "ToorCon Seattle 2008: Nuke plants, non-existent sub domain attacks, muffin diving, and Guitar Hero | Zero Day | ZDNet.com". Blogs.zdnet.com. Retrieved 2013-01-25.
  20. Brian Krebs (2008-04-30). "More Trouble With Ads on ISPs' Error Pages". Washington Post. Archived from the original on 2011-05-03. Retrieved 2008-05-19.
  21. Robert McMillan (2008-04-19). "EarthLink Redirect Service Poses Security Risk, Expert Says". PC World. Retrieved 2008-05-19.
  22. Goodin, Dan (2009-03-30). Busted! Conficker's tell-tale heart uncovered. The Register. Retrieved 2009-03-31.
  23. Bowes, Ronald (2009-03-30). Scanning for Conficker with Nmap. Skullsecurity.org. Retrieved 2009-03-31.
  24. Asadoorian, Paul (2009-04-01). Updated Conficker Detection Plugin Released. Tenable Security. Archived from the original on 2010-09-26. Retrieved 2009-04-02.
  25. Rodney (2009-08-02). "Dan Kaminsky Feels a disturbance in The Internet". SemiAccurate. Retrieved 2013-01-25.
  26. https://www.theregister.co.uk/2009/07/30/universal_ssl_certificate/
  27. Ries, Ulie "Crackers publish hackers' private data", heise online, 2009-7-31. Retrieved on 2009-7-31.
  28. Goodin, Dan "Security elite pwned on Black Hat eve", The Register, 2009-7-29. Retrieved on 2009-7-31.
  29. Zetter, Kim "Real Black Hats Hack Security Experts on Eve of Conference", Wired.com, 2009-7-29. Retrieved on 2009-7-31.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.