DNS hole patched - for now

THE COMPUTER INDUSTRY has pulled together in a mad race to save the interwibble from falling into the evil clutches of hackers, which could have been caused by a recently discovered Domain Name System (DNS) flaw.

The vulnerability discovered in the DNS could have led to a serious phishing problem in which people were led to which fake websites and tricked into divulging sensitive information apparently.

The flaw was such that no matter which address users typed in to their browsers, it would still mean they could be hijacked and routed to a malicious site instead.

A security boffin for IOActive, by the name of Dan Kaminsky, was the first to stumble across the weakness six months ago “completely by accident”. Kaminski noted, "I was looking at something that had nothing to do with security".

He immediately contacted industry Bigshots like the Vole, Cisco and Sun in order to get some help in fixing the problem.

"A lot of people really stepped up and showed how collaboration can protect customers" said Kaminsky who worked with 16 other boffins at Mighty-Soft’s Redmond campus to come up with a fix. He also set up a web site where people can check to see if their computers are susceptible to the flaw.

The Vole released a patch in a software update package yesterday, and it’s believed that automatic updating should be able to ward off the threat for the time being.

"People should be concerned but they should not be panicking," noted Kaminsky, who added, "we have bought you as much time as possible to test and apply the patch."

The technical details of the DNS problem are currently being kept pretty hush hush, in order to prevent, as far as possible, naughty hackers figuring out how to use it. But let’s face it, with a challenge like that being thrown down, it might just be a matter of time. µ

L’Inq
AFP