From Wikipedia, the free encyclopedia

Dan Kaminsky
Kaminsky in 2007. Photo: Dave Bullock / eecue.com
Occupation	Computer security researcher
Known for	Discovering the 2008 DNS cache poisoning vulnerability

Dan Kaminsky is a security researcher and Director of Penetration Testing for IOActive. He formerly worked for Cisco and Avaya.^[1][2] He is known among computer security experts for his work on DNS cache poisoning, including showing that the Sony Rootkit had infected at least 568,200 computers^[3] and for his talks at the Black Hat Briefings.^[2]

Sony Rootkit

During the Sony BMG CD copy protection scandal, Kaminsky used DNS cache snooping to find out whether or not servers had recently contacted any of the domains accessed by the Sony rootkit. He used this technique to estimate that there were at least 568,200 networks that had computers with the rootkit.^[3]

Earthlink and DNS lookup

In April 2008 Kaminsky realized a growing practice among ISPs potentially represented a security vulnerability. Various ISPs have experimented with intercepting return messages of non-existent domain names and replacing them with advertising content. This could allow hackers to set up phishing schemes by attacking the server responsible for the advertisements and linking to non-existent subdomains of the targeted websites. Kaminsky demonstrated this process by setting up Rickrolls on Facebook and PayPal.^[1][4] While the vulnerability used initially depended on part that Earthlink was using BareFruit to provide its advertising, Kaminsky was able to generalize the vulnerability to attack Verizon by attacking its ad provider, Paxfire.^[5]

Kaminsky went public after working with the ad networks in question to eliminate the immediate cross-site scripting vulnerability.^[6]

Flaw in DNS

In July 2008, CERT announced that Kaminsky had discovered a fundamental flaw in the DNS protocol itself. The flaw could allow attackers to easily perform cache poisoning attacks on any nameserver.^[7] With most Internet-based applications depending on DNS to locate their peers, a wide range of attacks became feasible, including web site impersonation, email interception, and authentication bypass via the "Forgot My Password" feature on many popular websites.

Kaminsky had worked with DNS vendors in secret since earlier in the year to develop a patch to make exploiting the vulnerability more difficult, which was released on July 8, 2008.^[8] The vulnerability itself has not been fully patched, as it is a design flaw in the DNS itself.^[9]

Kaminsky had intended not to publicize details of the attack until 30 days after the release of the patch, but details were leaked on July 21, 2008.^[10] The information was quickly pulled down, but not before it had been mirrored by others.^[11]

Kaminsky received a substantial amount of mainstream press after disclosing his vulnerability^[12][13] , but experienced some backlash from the computer security community for not immediately disclosing his attack.^[14]

Conficker Virus Automated detection

On March 27, 2009, Kaminsky discovered that Conficker-infected hosts have a detectable signature when scanned remotely.^[15] Signature updates for a number of network scanning applications are now available including NMap^[16] and Nessus.^[17]

Flaws in Internet X.509 Infrastructure

In 2009, in cooperation with Meredith L. Patterson and Len Sassaman, Kaminsky discovered numerous flaws in the SSL protocol, including the use of MD2 by Verisign in one of their root certificates, and parsing errors allowing attackers to successfully request certificates for sites they don't control.^[18][19]

Attack By "Zero For 0wned"

On July 28, 2009, Kaminsky, along with several other high-profile security consultants, experienced the publication of their personal email and server data by hackers associated with the "Zero for 0wned" online magazine^[20][21][22] The attack appeared to be designed to coincide with Kaminsky's appearance at the Black Hat Briefings and Defcon conferences.

External links

• Wired article on the Dan Kaminsky DNS story
• Dan Kaminsky, Cricket Liu and Scott Rose on DNSSEC

References