Microsoft among companies announcing action against hijacking internet scam by closing loophole
A flaw in the way the internet works has prompted the "largest security update" in the history of the web, and fears of millions of people remaining exposed to criminals and malicious hackers.
Microsoft was among net companies yesterday which announced action to close the loophole that has potentially affected every site on the web.
Dan Kaminsky, a director at the American security specialist IO Active, who immediately contacted big technology firms to alert them to the problem, spotted the bug this year.
The scam involved hijacking internet addresses and sending surfers to websites other than those they intended to see. By this route criminals stood the chance of tricking victims into handing over personal details or making payments to the wrong people.
Details of the bug, which uses a technique known as “cache poisoning”, has not been made public. The idea is to let firms find a solution before hackers learn how to exploit the situation further.
"Computers use the equivalent of address books to figure out where they need to go on the web. This attack could compromise that by attacking the servers that give out the addresses," said Rich Mogull, of the US-based firm Securosis.
Although there is no evidence of the bug being exploited by hackers, news of the flaw drew an unprecedented response from the technology industry. Large companies, including Microsoft and Cisco Systems, scrambled to fix the problem.
"This is the largest synchronized security update in the history of the Internet," said Kaminsky. "The severity of this bug is shown by the number of those who are on board with patches."
As fixing the problem is largely the duty of those who operate the millions of web servers, which hold all the information on the Internet, rather than those who use the web, most computer users will not have to do anything.
However, a failure to update software could mean surfers still being at risk. And the fixes may not make things entirely safe. The US Computer Emergency Readiness Team, an American agency which deals with security breaches, said that even the changes put forward by Microsoft and others would not remove all possibilities of a hijack. "It is important to note that without changes to the DNS [domain name system] protocol these mitigations cannot completely prevent cache poisoning," said the agency on its website.
Kaminsky said he would reveal more details about the problem at a computer security conference next month. It is not the first time that significant flaws at the heart of the internet have been exposed. Last week servers belonging to Icann, the group which administrates the way names on the net are handed out, were briefly hit by Turkish hackers. A group calling itself NetDevilz broke into the Icann website and replaced the organization's normal web pages with angry messages.
So-called cyber-terrorism - including hacking attacks and concerted attempts to bring down government websites - have gained a high profile in recent months, leading to NATO agreeing to fund a cyber-crime prevention center in east Europe. This week a report by the US Senate's armed services committee emphasized the need for greater security.
"We assess that nations ... have the technical capabilities to target and disrupt elements of the US information infrastructure."
EXCELLENT !!!!!!!!!
ReplyDelete