Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2012
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

DNSSEC Error Caused NASA Website To Be Blocked

Comcast's new DNSSEC-based service detected improper signing of NASA site

The hazards of early DNSSEC adoption: A misconfiguration in NASA’s Domain Name System Security Extensions (DNSSEC) implementation on its website caused Comcast’s network to block users from the site last week.

This is a glaring example of the difficulties in today’s mostly manual process of configuring DNS servers to support the new security protocol that prevents attacks that redirect users to malicious websites. The DNSSEC protocol basically ensures DNS entries remain unchanged in transit and are digitally signed to ensure their authenticity.

NASA had incorrectly signed DNSSEC in its implementation of the new security protocol last week, causing Comcast’s newly DNSSEC-enabled service to automatically block access to the site. Comcast earlier this month became one of the first major ISPs in North America to fully run the DNSSEC protocol as part of its services.

By pure coincidence, NASA's website woes occurred the day part of the Web went dark in protest of controversial anti-piracy legislation, leading some users and pundits to inaccurately speculate this was Comcast’s way of protesting the government-based bills. Far from it: Turns out Comcast's newly deployed DNSSEC service did the right thing by detecting an invalid digital signature on NASA’s DNSSEC-signed domain, and then blocking users from accessing what appeared to be a potential security threat.

Jason Livingood, vice president of Internet Systems Engineering for Comcast Cable Communications, says Comcast studied the problem and found it had to do with a domain-signing error. Comcast worked with NASA to quickly remediate it, and it wasn’t the first signing error the ISP has seen: "We’ve seen this same thing a few times before [elsewhere]," he says.

Comcast, with input from NASA, published a detailed report on the issue yesterday (PDF) as a way to help other early DNSSEC adopters.

NASA had failed to conduct a double-signing process. It signed "nasa.gov" with a new key pair, but the upstream chain of the ".gov" domain had an older key pair that the agency didn’t use in the signing process. That was all it took for Comcast’s DNSSEC to detect a problem with the NASA site when its users tried to visit.

Livingood says his company detected other domains in .gov yesterday with the same problem, but it’s unclear so far whether this is related to NASA’s issue or these are new cases. "This happens around key rollover time,” he says. "This is an area we’re focused on, and we will continue to conduct periodic analysis when we observe failures and try to publish them" to help other early DNSSEC adopters, he says.

[Researcher points to fundamental problems in SSL and DNSSEC, and says it's time for users to take control of trust. See Time For A Better Web Of Trust?]

DNSSEC expert Dan Kaminsky says this is an example of the kinds of short-term troubles with the manual processes required in early adoption of the technology. But these manual DNSSEC processes will eventually be fully automated, which will eliminate these types of issues, he says.

Livingood says it’s not surprising that these problems are cropping up as organizations roll out DNSSEC. "DNSSEC is relatively new for a lot of domains," he says. "Maybe they’re doing their first rollover, and it’s probably a process or automation [issue]," he says.

Cricket Liu, vice president of architecture at Infoblox, says it’s telling that a scientific organization could err in its DNSSEC cutover. “If even the rocket scientists can't get it right, what about the rest of us?” Liu quips. “To me, this really reinforces the argument that DNSSEC is so complex that it requires automation.”

But key-signing key (KSK) rollovers are not easy to automate, he notes. “KSK rollovers are difficult to automate completely because one step in the rollover -- submitting your [delegation signer] record to your parent zone -- isn't standardized. But even providing guidance to the administrator as to what to do and when to do it would have been valuable in this case,” Liu says.

As a pioneering adopter of DNSSEC, Comcast basically took the heat here. Liu says that’s unfortunate: “It's too bad that Comcast took the blame for this failure. In my opinion, they should be commended for deploying DNSSEC ahead of most ISPs. This sort of failure will happen occasionally as new zones are signed and administrators learn the ins and outs of managing DNSSEC-signed zones,” Liu says.

NASA had not responded to press inquiries as of this posting.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
joes12
50%
50%
joes12,
User Rank: Apprentice
1/30/2012 | 5:15:37 AM
re: DNSSEC Error Caused NASA Website To Be Blocked
DNSSEC is a protocol extension to the internet's
Domain Name System (DNS) that provides assurance that the
information received from a Domain Name Server is authentic. For example,
when a URL is typed into a browser, a user can be assured the IP
address the machine connects with is correct.-
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.