[ insider_reports_insider ]
Design, Not Patching, Key To Secure Software
David Utter
Staff Writer
2008-07-30
 Insider Reports RSS Feed
The current DNS cache poisoning variation requiring a fix on numerous nameservers around the globe could have been anticipated and stopped; one developer did that in 2000.
 | | Design, Not Patching, Key To Secure Software |  |
The chase is on, and security pros race after attackers in trying to get a critical DNS issue fixed. Although an advisory and patch became public in early July, getting that patch to every system that needs it may not be happening at a fast enough pace to stay ahead of criminals.
Already, two exploits for the DNS flaw appear in code on Metasploit, a testing tool that can be used for unfriendly purposes. The ability to exploit the flaw in a way that would redirect a major financial institution's visitors to a fake site promises disastrous consequences without a fix.
The need for a patch didn't need to exist. Security expert Bruce Schneier pointed out how a design that considered security would have helped against these possible exploits.
As he further noted, one developer did anticipate this issue, all the way back in 2000. Although those in the know will wink and nudge others about how everyone knew DNS was insecure, cryptographer Daniel J. Bernstein figured out source port randomization eight years ago and tucked it into djbdns, a DNS program he created.
"Bernstein didn't discover Kaminsky's attack; instead, he saw a general class of attacks and realized that this enhancement could protect against them," said Schneier.
"That's what a good design looks like. It's not just secure against known attacks; it's also secure against unknown attacks. We need more of this," he continued.
Security suffers when developers become more focused on the accomplishment of the task presented to software rather than its implications. Including security perspectives during the development process, as Bernstein demonstrated, isn't a panacea against all future attacks, but should work to stop more than an insecure application does.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
