|
|
Major DNS Security Flaw Details LeakedDATE: 22-JUL-2008 One of the many things that researchers agreed on in the major coordinated fix of a flaw in the DNS earlier this month was to withhold details on the vulnerability itself in order to give users enough time to apply updates. Too bad, another researcher spilled the beans.Halvar Flake, talented in the ways of reverse-engineering and not, it seems, part of any confidentiality agreement, speculated on the details of the attack in his blog. Flake disagrees on the utility of the 29 day blackout period; he argues that people are better off with more information in this case. He says "It feels like we're all trying to rock the train." (To get the rest of the joke preceding that punch line, read his blog.)Flake dismissed his own expertise and assumed his guess must be wrong, but turns out he was right. Matasano Security released their own blog on Monday announcing that Flake was right and delving further into the details. They quickly realized they shouldn't have done that and pulled the blog entry, but too late: For instance, my own RSS reader had already gotten the entry and I have a copy of it.Let's hope that Flake is right and that the silence period is not really advantageous, because the details of the attack became generally known 11 days after the patch, not 29. In the meantime, patch as fast as you can.Originally posted on the PC Magazine security blog, Security Watch.
|
|
|
Data Protection Virtual Tradeshow
Available On-Demand
Join Cameron Crotty and experts as they explore best practices and solutions needed to maintain a secure flow of data.
|
|
|
