Risk
2/14/2012
04:19 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Becomes Largest Public DNS Provider

Search giant's DNS service, now handling 70 billion requests a day, also makes Google more knowledgeable about what people are doing online.

Office 365 Vs. Google Apps: Top 10 Enterprise Concerns
Office 365 Vs. Google Apps: Top 10 Enterprise Concerns
(click image for larger view and forslideshow)
Google has become the largest public DNS service in the world, an event that might either please or frighten you, depending on your view of Google.

The company launched Google Public DNS in December 2009 and on Tuesday said its service is handling more than 70 billion requests a day.

Google software engineer Jeremy K. Chen likens DNS to a phone book for the Internet, a comparison that presumes a familiarity with phone books that might be absent in many younger Internet users. "If you had to look up hundreds or thousands of phone numbers every day, you'd want a directory that was fast, secure and correct," he said in a blog post. "That's what Google Public DNS provides for tens of millions of people."

Although Google's stated goal with its DNS service might be to make the Internet faster, more secure, and more easily organized through search, its advertising business is likely to perform better as a consequence of that goal.

[ Networks aren't always friendly. Read 500 Malware Networks Available To Launch Attacks. ]

DNS stands for Domain Name System. It is a service that maps numeric 32-bit IPv4 and 128-bit IPv6 addresses, such as 74.125.224.72, to alphanumeric domain names such as Google.com.

Providers of DNS service have considerable power: They can disassociate domain names and IP addresses, making websites unreachable by those using domain names.

When DNS providers do so, it tends to be at the direction of law enforcement authorities. But such takedowns are not always considered just or well-executed. The recent controversy surrounding proposed anti-piracy bills SOPA and PIPA was partly because the draft legislation would have forced ISPs to implement DNS filtering to protect copyrighted content.

Cricket Liu, vice president of architecture at Infoblox, a maker of networking control hardware, says that whether one is concerned about Google's growing power as a DNS provider depends on whether one has a charitable or skeptical view of the company.

"Google is providing fast, unfiltered DNS," he said, "and all of that is good. But they're also grabbing this huge stream of data, generated by all those people who use the company's DNS service."

Having access to that information reveals a lot about what people do and where they go online, he said. Companies such as OpenDNS have recognized the value of DNS data and have built businesses by delivering paid advertising in place of a browser-generated error page when users mistype URLs and by providing additional security and filtering services.

Google states explicitly that Google Public DNS "never blocks, filters, or redirects users, unlike some open resolvers and ISPs."

However, Open DNS founder and CEO David Ulevitch took issue with this claim in a 2009 blog post. "Google claims that [its] service is better because it has no ads or redirection," he wrote. "But you have to remember they are also the largest advertising and redirection company on the Internet."

Google also maintains a separate privacy policy for Google Public DNS. The company says it maintains two sets of server logs related to the service: temporary and permanent. The temporary logs contain user IP addresses and those are deleted in 24 to 48 hours (barring a court order to the contrary). The permanent logs, which contain city-level location data but nothing personally identifiable, are retained for at least two weeks. A small random sample taken from the permanent logs is kept indefinitely.

Google says it does not share public DNS data with other services, though it's not clear whether this data firewall will persist after March 1, when Google consolidates its privacy policies. A Google spokesperson did not immediately respond to a request for comment.

Hacks of Comodo and DigiNotar exposed weakness in the Secure Sockets Layer protocol. The new Dark Reading supplement shows you what's being done to fix it. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Michael Martinez
50%
50%
Michael Martinez,
User Rank: Apprentice
2/14/2012 | 10:35:28 PM
re: Google Becomes Largest Public DNS Provider
"Excuse me -- but WHY does God need a starship?"

How is it that Google is now the largest DNS provider in the world? They claim they service 70 billion DNS requests a day. Great!

How many requests are the OTHER DNS providers serving per day? I'd just like to see some official, trustworthy data, not more egregious marketing claims.

Thank you.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6123
Published: 2014-12-28
IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs.

CVE-2014-6160
Published: 2014-12-28
IBM WebSphere Service Registry and Repository (WSRR) 8.5 before 8.5.0.1, when Chrome and WebSEAL are used, does not properly process ServiceRegistryDashboard logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.