By Dan Goodin in San Francisco
25th July 2008
More than two weeks after security researchers warned of a critical
defect in the net's address lookup system, some of the world's biggest
internet service providers - including AT&T, BT, Time Warner and Bell
Canada - have yet to install a patch inoculating their subscribers
According to an informal survey of Register readers, 15 ISPs failed the
"Check my DNS"  test (see button to the right) on the website of
researcher Dan Kaminsky, who discovered the bug. Now that attack code
exploiting the vulnerability has been leaked into the wild , millions
of subscribers are at risk of being silently redirected to impostor
sites that try to install malware or steal sensitive information.
Comcast and Plusnet were the only two ISPs we found that weren't
The lack of action comes after Kaminsky, domain name resolution guru
Paul Vixie and others have repeatedly warned that the vulnerability has
the potential to wreak havoc on the net. Their advisories became more
urgent following the leaking of the vulnerability details, which
Kaminsky intended to keep private until next month's Black Hat
conference in Las Vegas.
Attend Black Hat USA, August 2-7 in Las Vegas,
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.
Visit product displays by 30 top sponsors in
a relaxed setting. http://www.blackhat.com