New Open-Source Technology Locks Down User's DNS Connection

OpenCrypt secures connection between end users and their DNS services

The connection between a user and his or her DNS service can now be locked down with an encrypted session to prevent man-in-the-middle attacks, spoofing, or sniffing: OpenDNS has written an open-source tool to secure that traditionally exposed link.

OpenDNS today offered a first release of its new DNSCrypt tool, which was built for OpenDNS's own DNS service and is also available in the public domain. David Ulevitch, founder and CEO of OpenDNS, hopes the technology will catch on to secure what he calls the "last mile" in DNS communications. It's basically akin to an SSL connection, but for DNS, he says. It uses elliptical curve cryptography to encrypt the traffic between the user and DNS.

And it's not a replacement for the emerging DNSSEC technology, which digitally signs DNS responses to ensure a website is who it says it is, for instance.

DNSCrypt could work alongside DNSSEC, Ulevitch says. "It's complementary to DNSSEC and all other DNS security services. But unlike DNSSEC, which requires everyone in the chain to use DNSSEC for it to work, DNSCrypt has immediate security and privacy benefits as soon as you install it for all DNS traffic between you and OpenDNS," he says.

The discovery of the DNS cache poisoning flaw a few years ago by researcher Dan Kaminsky first brought DNS security issues into the spotlight. DNSSEC, meanwhile, has slowly been gaining traction at the upper levels of the Internet architecture, with the root servers and main domains adopting it.

But the link between the user and the DNS service, especially in residential ISP networks and unsecured WiFi networks, has remained exposed, leaving users vulnerable to man-in-the middle and other malicious attacks and privacy exposure.

"OpenDNS is addressing the serious issue of DNS query privacy -- this is an issue that many have otherwise overlooked or incorrectly dismissed as irrelevant. It is an important step forward in network privacy and it will improve the Internet," said security researcher Jacob Applebaum, who is one of the key members of the TOR Project, in a statement. "It is wonderful that OpenDNS has decided to build on a free software base and doing so with openly specified ideas is a solid foundation for a safer Internet."

DNSCrypt initially is available for Macintosh machines only, but Ulevitch says it eventually will run on other platforms once the open-source code becomes available for the DNS security tool. "I encourage developers to get involved with DNSCrypt, and use their skills to help make the Internet a more privacy-rich and safe place," Ulevitch said in a statement.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights