Web security flaw uncovered
Security researchers on Tuesday said they had discovered an enormous flaw that could let hackers steer most people using corporate computer networks to malicious websites of their own devising.
For bad news, that’s pretty impressive. But there are two pieces of good news: First, no bad guys are known to be using the flaw yet. And second, in a possibly unprecedented display of industry cooperation, virtually every major software company affected is issuing patches to fix the problem.
System administrators will have 30 days to apply those patches -- from the likes of Microsoft Corp., Sun Microsystems Inc., Red Hat Inc. and others -- before the details of the flaw are disclosed at the Black Hat security conference in Las Vegas.
Security experts -- including the man who discovered the flaw, Dan Kaminsky of security firm IOActive Inc. -- hope that the patches are broad enough that evil types won’t be able to reverse-engineer them to exploit the vulnerability.
“We got lucky in this particular bug, because it’s a design flaw,” Kaminsky said in an interview. “It shows up in everyone’s network, but the fix is a design fix that doesn’t point directly at what we’re improving.”
US CERT, the Computer Emergency Readiness Team at the Department of Homeland Security, issued an alert Tuesday on the scope of the problem. CERT made the initial discovery seem like child’s play.
“It took a couple of hours to find the bug,” said Kaminsky, “and a couple of months to fix it.”
Kaminsky said he stumbled across the hole in the so-called DNS system for steering people to the websites they are seeking “by complete and total accident.” Smaller DNS flaws have been used before to “poison” the servers that send people to the numerical address of the website name they enter.
But this failing is at least one order of magnitude bigger, and perhaps several.
“This is about the integrity of the Web, this is about the integrity of e-mail,” Kaminsky said. “It’s more, but I can’t talk about how much more.”
--
