New Open-Source Technology Locks Down User's DNS Connection

The connection between a user and his or her DNS service can now be locked down with an encrypted session to prevent man-in-the-middle attacks, spoofing, or sniffing: OpenDNS has written an open-source tool to secure that traditionally exposed link.

OpenDNS today offered a first release of its new DNSCrypt tool, which was built for OpenDNS's own DNS service and is also available in the public domain. David Ulevitch, founder and CEO of OpenDNS, hopes the technology will catch on to secure what he calls the "last mile" in DNS communications. It's basically akin to an SSL connection, but for DNS, he says. It uses elliptical curve cryptography to encrypt the traffic between the user and DNS.

And it's not a replacement for the emerging DNSSEC technology, which digitally signs DNS responses to ensure a website is who it says it is, for instance.

DNSCrypt could work alongside DNSSEC, Ulevitch says. "It's complementary to DNSSEC and all other DNS security services. But unlike DNSSEC, which requires everyone in the chain to use DNSSEC for it to work, DNSCrypt has immediate security and privacy benefits as soon as you install it for all DNS traffic between you and OpenDNS," he says.

The discovery of the DNS cache poisoning flaw a few years ago by researcher Dan Kaminsky first brought DNS security issues into the spotlight. DNSSEC, meanwhile, has slowly been gaining traction at the upper levels of the Internet architecture, with the root servers and main domains adopting it.

But the link between the user and the DNS service, especially in residential ISP networks and unsecured WiFi networks, has remained exposed, leaving users vulnerable to man-in-the middle and other malicious attacks and privacy exposure.

"OpenDNS is addressing the serious issue of DNS query privacy -- this is an issue that many have otherwise overlooked or incorrectly dismissed as irrelevant. It is an important step forward in network privacy and it will improve the Internet," said security researcher Jacob Applebaum, who is one of the key members of the TOR Project, in a statement. "It is wonderful that OpenDNS has decided to build on a free software base and doing so with openly specified ideas is a solid foundation for a safer Internet."

DNSCrypt initially is available for Macintosh machines only, but Ulevitch says it eventually will run on other platforms once the open-source code becomes available for the DNS security tool. "I encourage developers to get involved with DNSCrypt, and use their skills to help make the Internet a more privacy-rich and safe place," Ulevitch said in a statement.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.