Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2012
03:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DNSSEC Error Caused NASA Website To Be Blocked

Comcast's new DNSSEC-based service detected improper signing of NASA site

The hazards of early DNSSEC adoption: A misconfiguration in NASA’s Domain Name System Security Extensions (DNSSEC) implementation on its website caused Comcast’s network to block users from the site last week.

This is a glaring example of the difficulties in today’s mostly manual process of configuring DNS servers to support the new security protocol that prevents attacks that redirect users to malicious websites. The DNSSEC protocol basically ensures DNS entries remain unchanged in transit and are digitally signed to ensure their authenticity.

NASA had incorrectly signed DNSSEC in its implementation of the new security protocol last week, causing Comcast’s newly DNSSEC-enabled service to automatically block access to the site. Comcast earlier this month became one of the first major ISPs in North America to fully run the DNSSEC protocol as part of its services.

By pure coincidence, NASA's website woes occurred the day part of the Web went dark in protest of controversial anti-piracy legislation, leading some users and pundits to inaccurately speculate this was Comcast’s way of protesting the government-based bills. Far from it: Turns out Comcast's newly deployed DNSSEC service did the right thing by detecting an invalid digital signature on NASA’s DNSSEC-signed domain, and then blocking users from accessing what appeared to be a potential security threat.

Jason Livingood, vice president of Internet Systems Engineering for Comcast Cable Communications, says Comcast studied the problem and found it had to do with a domain-signing error. Comcast worked with NASA to quickly remediate it, and it wasn’t the first signing error the ISP has seen: "We’ve seen this same thing a few times before [elsewhere]," he says.

Comcast, with input from NASA, published a detailed report on the issue yesterday (PDF) as a way to help other early DNSSEC adopters.

NASA had failed to conduct a double-signing process. It signed "nasa.gov" with a new key pair, but the upstream chain of the ".gov" domain had an older key pair that the agency didn’t use in the signing process. That was all it took for Comcast’s DNSSEC to detect a problem with the NASA site when its users tried to visit.

Livingood says his company detected other domains in .gov yesterday with the same problem, but it’s unclear so far whether this is related to NASA’s issue or these are new cases. "This happens around key rollover time,” he says. "This is an area we’re focused on, and we will continue to conduct periodic analysis when we observe failures and try to publish them" to help other early DNSSEC adopters, he says.

[Researcher points to fundamental problems in SSL and DNSSEC, and says it's time for users to take control of trust. See Time For A Better Web Of Trust?]

DNSSEC expert Dan Kaminsky says this is an example of the kinds of short-term troubles with the manual processes required in early adoption of the technology. But these manual DNSSEC processes will eventually be fully automated, which will eliminate these types of issues, he says.

Livingood says it’s not surprising that these problems are cropping up as organizations roll out DNSSEC. "DNSSEC is relatively new for a lot of domains," he says. "Maybe they’re doing their first rollover, and it’s probably a process or automation [issue]," he says.

Cricket Liu, vice president of architecture at Infoblox, says it’s telling that a scientific organization could err in its DNSSEC cutover. “If even the rocket scientists can't get it right, what about the rest of us?” Liu quips. “To me, this really reinforces the argument that DNSSEC is so complex that it requires automation.”

But key-signing key (KSK) rollovers are not easy to automate, he notes. “KSK rollovers are difficult to automate completely because one step in the rollover -- submitting your [delegation signer] record to your parent zone -- isn't standardized. But even providing guidance to the administrator as to what to do and when to do it would have been valuable in this case,” Liu says.

As a pioneering adopter of DNSSEC, Comcast basically took the heat here. Liu says that’s unfortunate: “It's too bad that Comcast took the blame for this failure. In my opinion, they should be commended for deploying DNSSEC ahead of most ISPs. This sort of failure will happen occasionally as new zones are signed and administrators learn the ins and outs of managing DNSSEC-signed zones,” Liu says.

NASA had not responded to press inquiries as of this posting.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
joes12
50%
50%
joes12,
User Rank: Apprentice
1/30/2012 | 5:15:37 AM
re: DNSSEC Error Caused NASA Website To Be Blocked
DNSSEC is a protocol extension to the internet's
Domain Name System (DNS) that provides assurance that the
information received from a Domain Name Server is authentic. For example,
when a URL is typed into a browser, a user can be assured the IP
address the machine connects with is correct.-
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...