Steve Goodbarn

An Independent DNS authority (ICANN) is critical to privacy

Network World recently reported on efforts by law enforcement push ICANN to require more disclosure when people set up web sites with registrars. See: Law enforcement lobbies hard for ICANN changes:

Currently the DNS is pretty good about maintaining anonymity. Among those recommendations are that ICANN should require its vetted registrars to check that the information used to register domain names isn't obviously fraudulent.

Also, they'd like to see a reformation of proxy services used to mask domain name ownership in the WHOIS database, while still respecting people's right to privacy.

The DNS (Domain Name System) structure now allows for almost complete anonymity, said Paul Hoare, senior manager and head of e-crime operations for SOCA.

The suggestions by law enforcement sound great. After all, wouldn't this make it easier to catch the bad guys? But there is a place where they require this already - China.

The Washington Post reports that both Go Daddy and Network Solutions, U.S. based registrars, are pulling out of China due to the intrusive nature of domain registrations. See: Network Solutions, GoDaddy cease registering Web sites in China.

Two major Internet domain name registration companies have ceased registering Web sites in China in response to intrusive new government rules that require applicants to provide extensive personal data, including photographs of themselves.

The rules, Go Daddy said, are an effort by China to increase monitoring and surveillance of Web site content and could put individuals who register their sites with the firm at risk. The company also said the rules will have a "chilling effect" on new domain name registrations.

Simply having ICANN, a non-government body, in charge of the DNS rather than government regulators is very important to protecting the Internet from undue control by governments. It was very farsighted for the Clinton administration to set up ICANN in this manner. 

Adoption of DNSSEC will allow for authentication while preserving anonymity. It will help law enforcement without being intrusive.

The internet and its applications are key tools for freedom and communications. If we value a free world we need to have a balance between ideal security and freedom to express viewpoints without censorship or fear of retaliation.

Security, confidence and progress

Yesterday the Wall Street Journal had an opinion piece "Your Medical Records Aren't Secure" that lamented the current insecure state of medical records. I found the following section particularly disturbing:

[I]n the past five years, according to the nonprofit Privacy Rights Clearinghouse, more than 45 million electronic health records were either lost, stolen by insiders (hospital or government-agency employees, health IT vendors, etc.), or hacked from outside.

Electronic record systems that don't put patients in control of data or have inadequate security create huge opportunities for the theft, misuse and sale of personal health information. The public is aware of these problems. A 2009 poll conducted for National Public Radio, the Kaiser Family Foundation and the Harvard School of Public Health asked if people were confident their medical records would remain confidential if they were stored electronically and could be shared online. Fifty nine percent responded they were not confident.

The privacy of an electronic health record cannot be restored once the contents are sold or otherwise disclosed. Every person and family is only one expensive diagnosis, one prescription, or one lab test away from generations of discrimination.

Privacy threats also come from external sources. A Network World interview with a top FBI official reveals that criminals and nations ". . . have the ability to access virtually any computer system, posing a risk that's so great it could "challenge our country's very existence." See: Cyberattacks are 'existential threat' to U.S., FBI says.

If you doubt the FBI, read iPhone, Safari, IE8, Firefox all fall on day one of Pwn2Own:

"Hackers took down Apple 's iPhone and Safari browser, Microsoft 's Internet Explore 8 (IE8) and Mozilla's Firefox within minutes at today's Pwn2Own contest, as expected."

So much for security over online medical records.

Privacy protection continues to erode both from a policy perspective and from a technology perspective. Technology can be used to ensure privacy or it can be used to invade privacy.

There are non-intrusive ways of ensuring privacy. They go beyond policy to simplifying encryption, providing internet-wide authentication (starting with DNSSEC deployment), and improving the security properties of the hardware and software that comprises IT infrastructure. Imagine that your medical records were encrypted such that only your doctor could read them and any transfer to a third party would require a crypto key in the possession of the patient or their guardian?

DNSSEC and more thorough encryption technologies are available today, although they are not widely deployed. Until these technologies are ubiquitous we will not reap the benefits of online medical records.

The USA is behind in DNS security

If you fear the United States is lagging in Internet security don't read this post.

Carolyn Duffy Marsan of Network World has an article, Top U.S. domain name registrars lag on DNS security, highlighting how U.S. DNS registrars, including Network Solutions and Go Daddy, are taking a wait and see attitude regarding adoption of DNS security extensions (DNSSEC):

The leading domain name registrars in the United States appear to be dragging their feet on the deployment of DNS Security Extensions, an emerging standard that prevents an insidious type of hacking attack where network traffic is redirected from a legitimate Web site to a fake one without the Web site operator or user knowing.

DNSSEC prevents cache poisoning attacks by allowing Web sites to verify their domain names and corresponding IP addresses using digital signatures and public-key encryption. Cache poisoning attacks are possible because of a serious flaw in the DNS that was disclosed by security researcher Dan Kaminsky in 2008.

In order for Web site operators and end users to benefit from DNSSEC, the standard must be supported at every level of the DNS heirarchy.

At the top of this heirarchy, the DNS root servers will support DNSSEC on July 1.

Next are the registries that operate the back-end servers for the various top-level domains. The registries have announced rolling deadlines for their DNSSEC deployments: .org and .edu in June; .net in December; and .com by March 2011.

However, none of the top 10 domain name registrars in the United States has committed to a deadline for deploying DNSSEC.

It will be difficult for small businesses, including a lot of small e commerce companies, to adopt DNSSEC if their registrar has not adopted.

One would think they would be motivated to provide this service as it could be a revenue enhancement and a competitive advantage for them - sign up for a web site and have it authenticated. It would be great for their customers.

Afilias, a top level domain operator (.org, .info, .mobi, etc.) and registry, provides a "1 click DNSSEC service". Comcast and others are moving ahead with DNSSEC services. So there are alternatives.

But the key to rapid and widespread deployment at low cost is for registries to offer this service. Industry must take the lead and not have this forced by regulation.

DNSSEC gets real; Mozilla Firefox browser add-on provides a key

I've been writing about DNSSEC and the many security vulnerabilities of the Internet for over a year. It has been frustrating to see the security situation worsen when a solution - DNSSEC - has been adopted at such a slow pace.

I think part of the reason for slow adoption is lack of awareness. Another is that DNSSEC is not apparent to users. But that is about to change.

Mozilla Firefox now offers a browser add-on that adds a key to your navigation window if the site is signed with DNSSEC. The add-on can be found here. This provides a visual clue to prevent DNS redirection, man-in-the-middle attacks, and cache poisoning from going undetected.

The key is green if the site is authenticated using DNSSEC. This is what the .ORG site PIR.org, which has been signed since last June, looks like:

And of course my company site, the only DNSSEC vendor other than open source ISC to have deployed DNSSEC:

The green key indicates that this site is signed by a valid signature and the Chain of Trust is validated by the resolving DNS server - it is authenticated. Click here to see why this is important.

The key is orange if the key is signed by a valid DNSSEC signature but the chain of trust is not validated by the resolving DNS server. This could indicate a partial implementation of DNSSEC, but you cannot trust the DNS answer. So I would get out of there.

 

The key is red if the domain is signed by an invalid DNSSEC signature. This could be caused by the DNSSEC signatures expiring, or the IP address of the signature does not match the IP address of the site. Enter at your own risk! I'd cancel my browser session if I were you.

Clicking on the keys provides more information about the site's security state. But the simple rule is "if it ain't green don't trust it". Sites that have not adopted DNSSEC will not have a key so you should be cautious. If the site is important to you it would be worth inquiring about their DNSSEC adoption status.

This free Mozilla add-on was developed by Ondrej Sury and Zbynek Michl of CZ.NIC, the .cz domain registry in the Czech Republic. I met Ondrej a year and a half ago at Internet Dagarna in Stockholm. Cz.nic is a leader in DNSSEC and ENUM adoption and I would like to see them get some credit for developing a very worthwhile application that I believe will become ubiquitous for internet users.

After all, why would you visit a site that was not authenticated by DNSSEC (and therefore could be a fake site or could allow for a man in the middle attack) if a competitors site was authenticated? Why would you bank online with an institution that was not authenticating their site - a trivial expense for the bank?

DNSSEC adoption proceeds with .ORG

The Public Interest Registry, which operates the .ORG domain though their service provider Afilias, announced that they will complete full adoption of DNSSEC in June.  An excerpt from their press release:

RESTON, VA--(Marketwire - March 11, 2010)-  .ORG, The Public Interest Registry (PIR) today announced plans to complete the final step to realizing full DNSSEC deployment in the .ORG registry by accepting second level signed .ORG zones beginning in June of 2010. This positions .ORG as the first generic top-level domain (TLD) to offer full DNSSEC deployment.

All registrars can now plan to offer an additional security service to their customers. The benefits of DNSSEC include the ability to thwart the increasing predominance of attacks like pharming, cache poisoning, and DNS redirection that have been used to commit fraud, distribute malware, and/or identity theft. DNSSEC, an upgrade to the internet infrastructure, protects Internet resolvers (clients) from forged DNS data, such as that created by DNS cache poisoning.

"We applaud PIR's leadership in the deployment of DNSSEC in the gTLD space," said Rod Beckstrom, president and chief executive officer of ICANN. "Opening up general registration of signed zones in .ORG is a major step forward."

This is a big step in improving Internet security. Without the authentication provided by DNSSEC we will never be secure online and we will never get full adoption of cloud computing (see recent comments from a former NSA Tech Chief "I don't trust the cloud" in Network World).

 

Charge your battery and lose control of your PC

Energizer and USCERT report that a backdoor has been found on USB battery chargers that could allow an attacker to have remote access and take control of Windows based PCs: Energizer DUO USB battery charger software allows unauthorized remote system access:

Overview

The software included with the Energizer DUO USB battery charger contains a backdoor that allows unauthorized remote system access.

I. Description

Energizer DUO is a USB battery charger. An optional Windows application that allows the user to view the battery charging status has been available on the Energizer website. The installer for the Energizer DUO software places the file UsbCharger.dll in the application's directory and Arucer.dllin the Windows system32 directory. When the Energizer UsbCharger software executes, it utilizes the UsbCharger.dllcomponent for providing USB communication capabilities. UsbCharger.dll executes Arucer.dll via the Windows rundll32.exe mechanism, and it also configures Arucer.dll to execute automatically when Windows starts by creating an entry in the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key.

Elinor Mills of CNET writes further:

The Trojan may have been in the software since it was first offered three years ago, according to Symantec.

"We were interested in finding out how long this file had been available to the public. The compile time for the file is May 10, 2007. It is impossible to say for sure that this Trojan has always been in this software, but from our initial inspection it appears so," Symantec wrote in a blog post. "The Trojan still operates whether this device is found or not, so a USB charger doesn't need to be plugged in for the Trojan to be functioning."

A battery charger than may have been compromising PCs for 3 years is not comforting. What new malware discoveries await us?

Network World Reports "Former NSA tech chief: I don't trust the cloud"

And neither should anyone else. Cloud computing offers big savings but without better authentication of users (including use of DNSSEC) it is folly to rely on the cloud for anything that is critical or private.

The Network World article by Tim Greene can be found here:

The former National Security Agency technical director told the RSA Conference he doesn't trust cloud services and bluntly admonished vendors for leaving software vulnerabilities unpatched sometimes for years.

Speaking for himself and not the agency, Brian Snow says that cloud infrastructure can deliver services that customers can access securely, but the shared nature of the cloud leaves doubts about attack channels through other users in the cloud. "You don't know what else is cuddling up next to it," he says.

Even the most secure cloud platform in the world, such as Google's, has been compromised by lack of user authentication. That is how Twitter was victimized. Improving our infrastructure is not all rocket science.