More Strength For DHS...

June 2008

DHS moves to strengthen domain name servers. The U.S. Homeland Security Department’s Science and Technology Directorate has awarded a contract to Secure64 Software to increase the security of the Internet’s Domain Name Servers (DNS). DNS is one of the most critical back-end processes on the Internet or any other IP network, but it operates somewhat transparently. DNS alleviates the burden of memorizing a Web site’s IP address, instead allowing the user to type in a simple domain name such as www.dhs.gov. The Internet would not be functional from a practical perspective without DNS. But despite its importance, most DNS implementations are not secured, leaving DNS transactions vulnerable to attacks such as pharming, cache poisoning, and DNS redirection. Pharming occurs when a hacker exploits DNS or host-file vulnerabilities on a computer to redirect the person to a Web site other than the one intended. These fraudulent sites may appear similar to the site the person was attempting to reach, confusing the person and perhaps tricking him or her into revealing sensitive information that can be used to commit identify theft or other crimes. Cache poisoning occurs when an attacker tricks a DNS into accepting falsified IP addresses for Web sites, which are then cached or stored temporarily by the servers. Because DNS servers do not flush their caches for a set period of time, the false information may lead many users to fraudulent Web sites that contain viruses or malware.