|
|
During the BlackHat conference, security researcher Dan Kaminsky revealed full details on the DNS cache-poisoning vulnerability that has been all over the media the last couple of weeks. Later on the day he received an award for the “Most Overhyped Bug.”
Was that award really justified? I think not.
DNS cache-poisoning vulnerabilities are nothing new. Such vulnerabilities have been known for more than 10 years. But now we live in a different time: The threat landscape has changed significantly, and there are gangs of criminals trying to get their Trojans installed on as many machines as possible, stealing as much information as they can. We have seen just this year that they would go as far as hacking hundreds of thousands of web pages just to distribute malware. It is safe to assume that they would take advantage of a vulnerability that allows them to route unsuspecting victims to their web sites, and this vulnerability allows them to do just that. And a lot more. Just combine the DNS vulnerability with other vulnerabilities and features, such as routing the emails of the “forgotten password” feature on web sites to them, to steal login details. No one takes seriously their being able to perform all the attacks that require them to act as a man-in-the-middle, because it’s so hard to do.
Considering all this, I don’t think it was overhyped. As of today there are probably still thousands of unpatched DNS servers. So stop shouting “hype,” go patch!
|
|
In the the end it sure was – or still is for some apple customers – a very serious bug. I’m really looking forward to the first combination of the DNS vulnerability and faked versions of Apple’s page with blacklisted applications to uninstall.
But in the beginning and without further knowledge there definitely was kind of a hype as everyone, even without a clue what DNS really does, was yelling about it.
Btw: congratulations for winning the Pwnie for lamest vendor response
The Pwnie Awards judges carefully considered the DNS bug and all other nominees before voting on the ‘Most Overhyped Bug’ award. I agree that the bug is quite serious and it had the potential to lead to massive exploitation, but it still generated way more hype than was justified.
The Metasploit exploit was released only 13 days after the patches were made available. At that time less than 50% of the servers were patched. If Dan Kaminsky and the media were right about the magnitude of the threat, the exploit would have turned the Internet into a warzone. Instead it was business as usual. There were some attacks, but the situation did not seem to be any worse than the exploitation of a standard browser 0day. Do you have data that disproves this?
Another point to consider is how much media attention was given to other vulnerabilities of similar magnitude in the past. I don’t think many people will disagree that the IGMP kernel bug was just as bad, and perhaps even worse than the DNS bug. It allowed you to own any Windows desktop, yet the media didn’t seem to care at all. This disproportionate amount of media attention makes the DNS bug deserving of a ‘Most Overhyped Bug’ award.
Alexander Sotirov
Pwnie Awards
Submit your own comments / message for this post