By John Leyden
9th July 2008
A flaw in how the internet's addressing system works that sparked a
patching frenzy on Tuesday night may has first been uncovered by a
student as long as three years ago.
Shortcomings in how the Domain Name System protocol is implemented by
multiple vendors facilitate DNS cache poisoning attacks, security
clearing house US CERT warned on Tuesday. Successful exploitation of
these security shortcomings creates a means for hackers to spoof DNS
replies, allowing for the redirection of network traffic or to mount
Security researcher Dan Kaminsky deserves a lot of credit for realising
the seriousness of the flaw and working behind the scenes with multiple
vendors over recent months leading up to co-ordinate this week's
patching activities. But Kaminsky may not have been the first to
discover the flaw, only the first with enough clout to mobilise action.
Three years ago Ian Green, then studying for his GIAC Security
Essentials Certification (GSEC), submitted a paper  that details the
same DNS spoofing vulnerability, the SANS Institute's Internet Storm
Attend Black Hat USA, August 2-7 in Las Vegas,
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.
Visit product displays by 30 top sponsors in
a relaxed setting. http://www.blackhat.com