Risk

1/25/2012
03:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DNSSEC Error Caused NASA Website To Be Blocked

Comcast's new DNSSEC-based service detected improper signing of NASA site

The hazards of early DNSSEC adoption: A misconfiguration in NASA’s Domain Name System Security Extensions (DNSSEC) implementation on its website caused Comcast’s network to block users from the site last week.

This is a glaring example of the difficulties in today’s mostly manual process of configuring DNS servers to support the new security protocol that prevents attacks that redirect users to malicious websites. The DNSSEC protocol basically ensures DNS entries remain unchanged in transit and are digitally signed to ensure their authenticity.

NASA had incorrectly signed DNSSEC in its implementation of the new security protocol last week, causing Comcast’s newly DNSSEC-enabled service to automatically block access to the site. Comcast earlier this month became one of the first major ISPs in North America to fully run the DNSSEC protocol as part of its services.

By pure coincidence, NASA's website woes occurred the day part of the Web went dark in protest of controversial anti-piracy legislation, leading some users and pundits to inaccurately speculate this was Comcast’s way of protesting the government-based bills. Far from it: Turns out Comcast's newly deployed DNSSEC service did the right thing by detecting an invalid digital signature on NASA’s DNSSEC-signed domain, and then blocking users from accessing what appeared to be a potential security threat.

Jason Livingood, vice president of Internet Systems Engineering for Comcast Cable Communications, says Comcast studied the problem and found it had to do with a domain-signing error. Comcast worked with NASA to quickly remediate it, and it wasn’t the first signing error the ISP has seen: "We’ve seen this same thing a few times before [elsewhere]," he says.

Comcast, with input from NASA, published a detailed report on the issue yesterday (PDF) as a way to help other early DNSSEC adopters.

NASA had failed to conduct a double-signing process. It signed "nasa.gov" with a new key pair, but the upstream chain of the ".gov" domain had an older key pair that the agency didn’t use in the signing process. That was all it took for Comcast’s DNSSEC to detect a problem with the NASA site when its users tried to visit.

Livingood says his company detected other domains in .gov yesterday with the same problem, but it’s unclear so far whether this is related to NASA’s issue or these are new cases. "This happens around key rollover time,” he says. "This is an area we’re focused on, and we will continue to conduct periodic analysis when we observe failures and try to publish them" to help other early DNSSEC adopters, he says.

[Researcher points to fundamental problems in SSL and DNSSEC, and says it's time for users to take control of trust. See Time For A Better Web Of Trust?]

DNSSEC expert Dan Kaminsky says this is an example of the kinds of short-term troubles with the manual processes required in early adoption of the technology. But these manual DNSSEC processes will eventually be fully automated, which will eliminate these types of issues, he says.

Livingood says it’s not surprising that these problems are cropping up as organizations roll out DNSSEC. "DNSSEC is relatively new for a lot of domains," he says. "Maybe they’re doing their first rollover, and it’s probably a process or automation [issue]," he says.

Cricket Liu, vice president of architecture at Infoblox, says it’s telling that a scientific organization could err in its DNSSEC cutover. “If even the rocket scientists can't get it right, what about the rest of us?” Liu quips. “To me, this really reinforces the argument that DNSSEC is so complex that it requires automation.”

But key-signing key (KSK) rollovers are not easy to automate, he notes. “KSK rollovers are difficult to automate completely because one step in the rollover -- submitting your [delegation signer] record to your parent zone -- isn't standardized. But even providing guidance to the administrator as to what to do and when to do it would have been valuable in this case,” Liu says.

As a pioneering adopter of DNSSEC, Comcast basically took the heat here. Liu says that’s unfortunate: “It's too bad that Comcast took the blame for this failure. In my opinion, they should be commended for deploying DNSSEC ahead of most ISPs. This sort of failure will happen occasionally as new zones are signed and administrators learn the ins and outs of managing DNSSEC-signed zones,” Liu says.

NASA had not responded to press inquiries as of this posting.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
joes12
50%
50%
joes12,
User Rank: Apprentice
1/30/2012 | 5:15:37 AM
re: DNSSEC Error Caused NASA Website To Be Blocked
DNSSEC is a protocol extension to the internet's
Domain Name System (DNS) that provides assurance that the
information received from a Domain Name Server is authentic. For example,
when a URL is typed into a browser, a user can be assured the IP
address the machine connects with is correct.-
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.