Information Security News: World's biggest ISPs drag feet on critical DNS patch

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2008/07/25/isps_slow_to_patch/

By Dan Goodin in San Francisco
The Register
25th July 2008

More than two weeks after security researchers warned of a critical 
defect in the net's address lookup system, some of the world's biggest 
internet service providers - including AT&T, BT, Time Warner and Bell 
Canada - have yet to install a patch inoculating their subscribers 
against attacks.

According to an informal survey of Register readers, 15 ISPs failed the 
"Check my DNS" [1] test (see button to the right) on the website of 
researcher Dan Kaminsky, who discovered the bug. Now that attack code 
exploiting the vulnerability has been leaked into the wild [2], millions 
of subscribers are at risk of being silently redirected to impostor 
sites that try to install malware or steal sensitive information. 
Comcast and Plusnet were the only two ISPs we found that weren't 
vulnerable.

The lack of action comes after Kaminsky, domain name resolution guru 
Paul Vixie and others have repeatedly warned that the vulnerability has 
the potential to wreak havoc on the net. Their advisories became more 
urgent following the leaking of the vulnerability details, which 
Kaminsky intended to keep private until next month's Black Hat 
conference in Las Vegas.

[1] http://www.doxpara.com/
[2] http://www.theregister.co.uk/2008/07/24/dns_exploit_goes_wild/

[...]


_______________________________________________      
Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com