Routing and DNS Security Ignored By ISPs 101
Bismillah (993337) writes "The re-routing of Google's public DNS servers last weekend was yet another example of how easy it is to 'steal the Internet' by abusing today's trust-based networks. Problem is, ISPs don't seem to care about that, or securing DNS which is another attack vector that doesn't require compromising end users' systems. Why isn't more done to secure routing and DNS then?"
The route announcement was likely unintentional. The chief scientist at APNIC noted that implementing RPKI would solve the problem, but far too few ISPs bother with it.
Re: (Score:2)
I have reported compromised sites, massive spamming IP addresses, malware hosting, exploit kits, all kinds of stuff to ISPs, obvious phishing-only domains, hosting providers, and registrars for a while now. Probably close to 1000 reports.
Many companies give a shit.
Many do not. They are here to make money and could care less if the guy renting the storage unit is cooking meth, so long as they make rent. Doesn't matter if the reputation of the storage unit goes down, or poison spills into the streets. As long
Re: (Score:2)
Most don't give a shit as long as the clients are paying the bills.
The hosting company I work for was like this at one point. The company VP (who has been fired since) make the final call and he said, "If they are current on their bill then ignore it." The only way he would shut a site down is if money was owed or the person complaining had some court order.
On and the VP would also send out SPAM his self while I was sitting here trying to stop SPAM in our mail servers. I hated that guy so much.
Re: (Score:3)
Groupe Telecom used to be like that since they considered themselves too big to fail (or rather too big to be taken down). I had a decent job until the final months of the job where my boss (Leo Kuvayev before his infamous spammer days) decided to team up with Alan Ralsky and Spam the crap out of some porn sites. Before they started they were assured by their account manager that all complaints would be ignored. After trying to talk them out of it I quit and moved on to another job.
A few months later I r
RE:Time=Money (Score:1)
Re: (Score:2)
The answer is Namecoin.
I want to use namecoin but it just isn't there yet needs some more work together the rough edges of first and more devs. If they want it to take off what they need to impliment is dns proxy that intersepts the namecoin quries and passes traditional dns through to your dns server of choice.
Re: (Score:3)
Sure, until the DNS steering comittee becomes headed by the representatives of Iran, North Korea, Pakistan and Jemen.
Re: (Score:2)
Sure, until the DNS steering comittee becomes headed by the representatives of Iran, North Korea, Pakistan and Jemen.
that would be a good thing.
Iran, Pakistan and North Korea would never even be able to agree on what to have for lunch. Hell, Iran and Pakistan would be at each others throats (Shiite Persians and Suni Arabs, so they'd block each other just because of that) and North Korea is completely ineffectual. It would be deadlock, leaving DNS implementers to their own devices.
Also, where the fsck is Jemen?
Re: (Score:2)
Oh please, the USA was far worse than your perceived paranoia about you being censored by some authority outside the USA. Did you know: The US Government seize international domains on the premise of copyright infringement, so yeah, pick your poison. I know which one I'd rather pick and its not the USA option.
Have you paid attentionto the situation in the UK? They are blocking pretty much any site the politicians in power veiw as unsavory and they are one of the more freedom respecting liberal nationsn just wait until China gets a say in what gets the the internet wide BanHammer or the Saudis get to ban any one saying something untasteful about Allah or Mohammad.
UN human rights: Cuba, Russia, China, Saudi Arabia (Score:2)
The UN council on human rights consists of 18 countries including Cuba, Russia, China, and Saudi Arabia. Do you really think an internet council is going to protect free speech? With Iran, China, or North Korea as the chair?
Re: (Score:2)
There is a chance this will change in the (near ?) future.
The US government says they are going to let ICANN 'go global':
http://www.ntia.doc.gov/press-... [doc.gov]
Re: (Score:2)
DNSSEC doesn't really change anything re DNS based blocking. To date I have seen 2 different actions re blocking, the first is seizure (e.g. where the US government has asked/ordered/forced the US-based VeriSign .com registrar to point dodgysite.com to a computer that displays domain seizure message). In this case the new domain records would be signed with DNSSEC and everything would validate.
The second is blocks at the ISP level (e.g. UK courts ordering blocking of pirate sites). Since these domains aren'
Re: (Score:2)
No this has little to do with end users. This is a big networks issue.
If your VPN endpoint also saw the hijacked route then you'd equally be stuffed.
obvious reason (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
You must live in some dumpy, backwards rural area where there's a monopoly.
I live in downtown Boston. There is only one option for an ISP that is >768kbps and $200/month.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Most of us have a Duopoly (Score:2)
You must live in some dumpy, backwards rural area where there's a monopoly.
That's pretty condescending. I live in one of the 10 largest metro areas in the US. My broadband choices at my house consist of Comcast where I can get 100mbit speeds or Frontier which gives 6mbit speeds if I want wired access. That means realistically I have one option if I give a shit about the speed of my internet connection. Not exactly what I'd call real competition. Oh I could cut the cord and go wireless I suppose but that has plenty of problems and I'd lose a lot of connection speed and gain a
Re: (Score:2)
Where the hell do *you* live?
I'm in freakin downtown Providence, RI and I have exactly two options: Cox or FiOS. Been here two years, already been screwed over by *both*.
Re: (Score:2)
If you can't put it on a billboard as a feature, they're not interested because it costs money without generating more users.
Seems a bit disturbing that "We help prevent your connection to Google from being hijacked by identity thieves" isn't considered a feature.
Re: (Score:2)
Re: (Score:2)
If you can't put it on a billboard as a feature, they're not interested because it costs money without generating more users.
Seems a bit disturbing that "We help prevent your connection to Google from being hijacked by identity thieves" isn't considered a feature.
They can't do this unilaterally.
RPKI and DNSSEC are important, but they won't work if the resource or domain owner doesn't use them. For example, Google's public DNS service performs DNSSEC validation, but Google's own DNS zones are unsigned and do not validate using DNSSEC. Even with automation, DNSSEC increases the administrative burden of running a domain, so I see why they don't, but I don't excuse them.
Re: (Score:2)
It isn't just the administrative burden.
A failure to get DNSSEC right could take down the domain for hours without an easy way to recover.
Re: (Score:2)
A failure to get DNSSEC right could take down the domain for hours without an easy way to recover.
What are you talking about? DNS does that, anyway.
DNSSEC records are distributed and expire just like any other record. Make a mistake deploying DNSSEC, then just fix it, and eventually the bad records will expire and the new ones will take over. The major issue I see is that the TLD registrar needs to hold DS records for your key, so now your registrar needs to do NS, DS, and glue records.
Worst case scenario, you lose the secure entry point keys. So, you use some out-of-band management interface to change
Re: (Score:2)
The complexity of DNSSEC makes it easier to make such a mistake.
Re: (Score:2)
Let me add something: it is extra risk in comparison to non-DNSSEC DNS deployment.
Re: (Score:2)
So you create a working configuration, and you script it.
This is not your neighborhood club's web site. This is Google. I'm sure they have the resources at hand to do configuration management on their DNS servers. So, once it's set up, you just need to renew the registrar's DS records appropriately. You need to communicate with your registrar regularly, anyway, to keep your zone from expiring. Unless you want your cloud to fall down like a Microsoft cloud.
Greater complexity is usually greater risk, but we a
Re: (Score:2)
" It's not that they won't "want" to implement it, it's that it would cost money and competition is completely insane right now for ISPs."
Are you in the United States? If so, you're nuts. Your local situation does not translate to the rest of the country.
80% of the people here live where there is a cable monopoly. Mostly Comcast or Time-Warner. In most places DSL is not as fast for the money, and satellite has too much latency for business use.
"Competition", my ass. They don't do it because it costs money, but their customers are locked-in, so they don't have to.
Why do you think broadband is so much more expensive in the U.S. than it
Re: (Score:2)
Because the cities grant monopolies to companies. You don't bring a dollar to a gunfight, unless you bring a lot of dollars.
Re: (Score:2)
Actually, ComCast is one of the few large providers that deploys DNSSEC and IPv6:
http://dns.comcast.net/ [comcast.net]
http://www.comcast6.net/ [comcast6.net]
Re: (Score:2)
Or I could just apt-get install bind9 and run my own dns server with much less hassle then configuring my host file on ever computer and devise on my network.
Re: (Score:2)
Re: (Score:2)
Realistic maybe? (Score:2)
Re: (Score:2)
Re: (Score:2)
Not that I think RPKI is bad, or it's good what RIPE is doing, but these stats say nothing about validation in the field.
Why the hell would they want Google DNS to work? (Score:4, Interesting)
Why the hell would they want Google DNS to work?
They intermediate DNS all the time,in order to do proxy caching, and to prevent you going to high bandwidth sites without a lot of difficultly, or to land you on a page when you hit a non-existant domain because of a typo, and they try to sell it to you.
One wireless carrier, on their WiFi hotspot-only options, used to move you off their 4G network and onto their 3G by having intentional "DNS outages" that pointing to Google's DNS worked around. 3G had a data cap for which they got paid, 4G was no data cap, so the benefit to them for you using the DHCP assigned DNS was enormous: large amounts of data charges.
Even if they aren't screwing with the results for their own reasons, you hitting Google for all your DNS lookups means that they can't cache DNS responses, which means that they have to support more DNS traffic out and responses in on their network than they otherwise would need to.
None of these are beneficial to their bottom line.
OpenDNS for the win (Score:1)
Not a shill, just educating: in case anyone needs better (and free) DNS for their parents/dumb relatives/noobs continuously getting spyware and malware by clicking on everything they see, OpenDNS is a great start. Their commercial product is useful for small/medium business as well. http://www.opendns.com/
The brilliant simplicity is that even if you get a dropper/adware/malware on your machine, if it can't resolve a malware domain to pull its payload from, it's effectively dead on your machine until your vi
If it's not broke, don't fix it (Score:4, Interesting)
I see this attitude all the time with managers. It's like a mantra:
It's blocking IPv6, it's blocking DNSSEC, it's blocking RPKI, it's blocking Windows XP retirements. There are a lot of improvements that are stymied because change is considered more scary than just living with the problem.
But it is broke. Computers are hugely complex and buggy. We need the upgrade treadmill just to stay ahead of threats to our computing. Computers are incredibly malleable, and collectively we need major changes. I would be seriously depressed if our current state became the pinnacle of computing.
Re: (Score:2)
Managers?
I see this all the time with tech-oriented people as well. They say that we don't need IPv6 because IPv4 and NAT works just fine, and XP is the best thing ever and it is just greed by Microsoft to not support it. What separates tech people and managers is that managers count money. IPv6 and DNSSEC implementation cost money.
Techies who oppose these often cloud their inability or non-desire to learn something new and "complex" in "if it works, don't fix it". Which of course also comes down to investm
Not yet (Score:2)
"too few ISPs bother with it" [RPKI] because "Cisco Systems is committed[4] to offering this functionality in Cisco IOS. Juniper Networks is working on an implementation[5] for Junos as well", i.e. it doesn't exist yet. DNSSEC exists, but is very challenging to implement and is fragile, though recent BIND implementations have improved that situation considerably. DANE will build on top of that, so there *is* hope for the future, but it is still the future.
Re: (Score:1)