DNS security still "as vulnerable as ever"

The security of domain name system (DNS) continues to be an issue for network administrators, despite the availability of more secure DNS servers such as BIND 9, according to a survey by network appliance company, Infoblox.

According to the survey, DNS infrastructure is modernising and coalescing around the most recent versions of BIND - a type of DNS server software. However, a problem Infoblox noted is more than 50 per cent of DNS servers still allow recursion and zone transfers, "indicating that the global DNS system is as vulnerable as ever". Recursion can leave DNS systems vulnerable to DNS cache poisoning and amplification attacks that can "bring down major networks", said Infoblox.

Security from A to Z

Click on the links below to find out more...

A is for Antivirus
B is for Botnets
C is for CMA
D is for DDoS
E is for Extradition
F is for Federated identity
G is for Google
H is for Hackers
I is for IM
J is for Jaschan (Sven)
K is for Kids
L is for Love Bug
M is for Microsoft
N is for Neologisms
O is for Orange
P is for Passwords
Q is for Questions
R is for Rootkits
S is for Spyware
T is for Two-factor authentication
U is for USB sticks/devices
V is for Virus variants
W is for Wi-fi
X is for OS X
Y is for You
Z is for Zero-day

The survey - conducted over the past three years - found the DNS system is growing overall, which is an indicator of internet growth in general.

At the same time, the use of BIND 9 DNS server code is increasing more quickly than other varieties of DNS server code. Infoblox considers BIND 9 more secure than older versions of BIND, as it "has a substantially better security track record ", according to Cricket Liu, Infoblox vice president of architecture.

Meanwhile, Microsoft DNS Server, which Infoblox considers a less secure type of DNS server code, has charted a continual rapid decline for three years. Liu wrote: "Microsoft DNS Server's [market] share continued its dramatic decline, from about 4.6 per cent to 2.7 per cent. Perhaps this is because administrators have become warier of exposing the Microsoft DNS Server and Windows operating systems directly to the internet."

Microsoft DNS Server market share fell from 10 per cent in 2005, to 4.6 per cent in 2006, then to 2.7 per cent in 2007, according to the survey. Infoblox said its decreased use was a positive step.

The survey was based on a sample that included five per cent of the IPv4 address space - nearly 80 million addresses.

Colin Barker writes for ZDNet.co.uk