DNS security improves as firms tool up to tackle spam
Configuration errors blot copybook
By
<http://forms.theregister.co.uk/mail_author/?story_url=/2007/11/20/dns_security_survey/>John
Leyden <http://search.theregister.co.uk/?author=John%20Leyden>More by
this author
Published Tuesday 20th November 2007 17:15 GMT
<http://whitepapers.theregister.co.uk/paper/view/279?td=toptxt>Download
free whitepaper - Building a Virtual Infrastructure from Servers to Storage
Domain name servers on the net are still often vulnerable to attacks
despite some marked improvements, according to a new survey.
Many organisations are making efforts to install the most recent
versions of BIND and eliminate Microsoft DNS for external servers.
But most still leave their systems open to denial of service and
pharming attacks by allowing recursion and zone transfers in response
to arbitrary requests from unauthenticated parties.
The third annual survey of domain name servers on the internet by
network appliance firm Infoblox also found evidence of growing
attempts to tackle spam. Infoblox's survey is based on a sample of
five per cent of the IPv4 address space of nearly 80m addresses.
DNS servers are essential network infrastructure components that map
domain names to IP addresses, directing internet inquiries to the
appropriate location. Should an organisation's DNS systems fail, all
internet functions including email, web access, e-commerce, and
extranets become unavailable.
Infoblox's survey found that the number of internet-facing DNS
servers increased from 9m in 2006 to 11.5m in 2007, indicative of the
overall growth of the internet. Percentage usage of the most recent
and secure version of open-source domain name server software - BIND
9 - increased from 61 per cent to 65 per cent over the last year. Use
of BIND 8, by contrast, dropped from 14 per cent in 2006 to 5.6 per
cent this year. Usage of the Microsoft DNS Server on web-facing
systems also fell, decreasing to to 2.7 per cent in 2007 from five
per cent last year.
Increased efforts to combat spam, at measured by the use of SPF
(Sender Policy Framework), was up from five per cent in 2006 to 12.6
per cent this year.
Against this broadly positive picture the Infoblox survey also
unearthed some negative developments. Continued deployment and
configuration mistakes are leaving the global DNS system vulnerable.
More than 50 per cent of internet name servers allow recursive
queries, much the same as last year. Permitting recursive queries
leaves systems more vulnerable to pharming attacks, which involves
poisoning systems with bogus records.
The number of DNS servers that allow zone transfers in response to
arbitrary requests grew from 29 per cent last year to 31 per cent in
2007. The practice leaves systems more vulnerable to denial of service attacks.
Only a practically invisible 0.002 per cent of zones tested support
DNSSec, the IETF standard that adds cryptographic authentication and
integrity checking to DNS systems. Infoblox reckons sysadmins remain
unconvinced of the benefits of the approach, or put off by the
complexity of the standard.
Infoblox's complete survey can be found
<http://www.infoblox.com/library/dns_resources.cfm>here.®
http://www.theregister.co.uk/2007/11/20/dns_security_survey/
