Go Daddy bans DNS harvesting

Go Daddy is blocking companies from harvesting its DNS records, the company has confirmed.
CTO Dave Koopman denied that Go Daddy has a “DNS Blackouts” policy, but confirmed that it has banned certain IP addresses from doing DNS queries for its customers’ domains. He wrote:

The rumor about “DNS Blackouts” was started by someone using Go Daddy servers to cache all Go Daddy DNS records on his personal servers for financial gain.
Back to our previous example of 100 queries a day. Instead of one person accessing 100 domain names, this individual was attempting to download tens of millions of Go Daddy DNS records – twice daily. While his behavior did not cause any system issues, we felt it best to revoke access to the offending IPs.
If Go Daddy finds unwanted activity in our network, Go Daddy takes actions to stop it.

That appears to be a reference to a blog post from DNSstuff.com founder R Scott Perry, who complained in early September about what he called a “Selective DNS Blackouts” policy.
Perry suggested that Go Daddy was trying to drum up interest in its Premium DNS service by providing poor DNS service to regular customers.
Blocking DNS queries from selected IP addresses draws to mind Go Daddy’s policy of banning DomainTools and other companies from harvesting Whois records in bulk.
In January, the company confirmed, that it was blocking commercial Whois aggregators including DomainTools. The ban appears to still be in affect for non-paying DomainTools users.
Like DomainTools, DNSstuff.com offers DNS monitoring and alerts for premium fees.

Bit-squatting – the latest risk to domain name owners

Forget phishing, forget cybersquatting, forget typosquatting, high-value domain name owners may have a whole new threat to worry about – “bit-squatting”.
This appears to be the conclusion of fascinating new research to be presented by Artem Dinaburg at the Black Hat and DEF CON hacker conferences in Las Vegas next week.
Defective internet hardware, it turns out, may be enabling a whole new category of typosquatting that could prove worrying for companies already prone to domain name abuse.
According to a summary of Dinaburg’s research, RAM chips can sometimes malfunction due to heat or radiation, resulting in “flipped bits”, where a 1 turns into a 0 or vice-versa.
Because the DNS uses ASCII encoding, a query containing a single flipped bit could actually send the user to a completely different domain name to the one they intended to visit.
To test the theory, Dinaburg appears to have registered the typo domain name mic2osoft.com. While it’s not visually confusing or a likely typo, in binary it is only one bit different to microsoft.com.
The ASCII binary code for the digit 2 is 00110010, which is only one bit different to the lower-case letter r, 01110010.
The binary for the string “microsoft” is:

011011010110100101100011011100100110111101110011011011110110011001110100

and the binary encoding for “mic2osoft” is (with the single changed bit highlighted):

011011010110100101100011001100100110111101110011011011110110011001110100

Therefore, if that one bit were to be accidentally flipped by a dodgy chip, the user could find themselves sending data to the bit-squatter’s domain rather than Microsoft’s official home.
I would assume that this is statistically only a concern for very high-traffic domains, and only if the bit-flipping malfunction is quite widespread.
But Dinaburg, who works for the defense contractor Raytheon, seems to think that it’s serious enough to pay attention to. He wrote:

To verify the seriousness of the issue, I bit-squatted several popular domains, and logged all HTTP and DNS traffic. The results were shocking and surprising, ranging from misdirected DNS queries to requests for Windows updates.
…
I hope to convince the audience that bit-squatting and other attacks enabled by bit-flip errors are practical, serious, and should be addressed by software and hardware vendors.

His conference presentations will also discuss possible hardware and software solutions.
For large companies particularly at risk of typosquatting, the research may also present a good reason to conduct a review of their trademark enforcement strategies.
I’m not going to be in Vegas this year, but I’m looking forward to reading more about Dinaburg’s findings.
The annual Black Hat and DEF CON conferences are frequently the venues where some of the most beautifully creative DNS hacks are first revealed, usually by Dan Kaminsky.
Kaminsky is not discussing DNS this year, judging by the agendas.
The conferences were founded by Jeff Moss, aka The Dark Tangent, who joined ICANN as its chief security officer earlier this year.

How Protect IP will get you hacked

The collection of DNS experts opposing the Protect IP Act today held a press conference to outline exactly why the proposed US piracy protection legislation is dangerous.
Protect IP, currently making its may through Congress, would force ISPs to intercept and redirect domain name look-ups for proscribed piracy sites.
It’s the latest in a series of attempts by the IP lobby to push through legislation aimed at curbing the widespread bootlegging of digital content such as music and movies.
But ICANN chair Steve Crocker, DNS uber-hacker Dan Kaminsky, David Dagon of Georgia Tech, VeriSign’s Danny McPherson and BIND supremo Paul Vixie all think the Act will have unintended and dangerous consequences.
They published a white paper explaining their concerns in May, which I wrote about here, and today ramped up the campaign by talking to reporters in Washington, DC.
Here’s the problem as they see it:
Today, the vast majority of internet users take the default DNS service from their ISP. Usually, the servers are configured automatically when you’re installing the ISP’s software.
Many users are also aware of alternative DNS providers such as Google and OpenDNS. Whatever you think of these services, you can be pretty confident they’re not out to steal your identity.
What Crocker et al are worried about is that content pirates will set up services similar to OpenDNS in order to enable users to visit domains that are blocked by Protect IP in their country.
Users can configure such a service in just 30 seconds, with a single click, the experts said. If they want access to the latest movies and music, they may do so without considering the consequences.
But if you sign up to use a DNS server provided by a bunch of movie pirates, you don’t necessarily have the same reassurances you have with OpenDNS or Google.
You’re basically signing up to pass all your domain name look-up data to proven rogues, what Kaminsky referred to during the press conference as “unambiguously bad guys”.
These bad guys may well direct you to the correct server for the Pirate Bay, but they may also hand you over to a spoof web site when you try to visit your bank.
You’ll think you’re looking at your bank’s site, and your computer will think it got a genuine IP address in response to its DNS query, but you’re really handing your login credentials to a crook.
DNS blocking already takes place with respect to content such as child pornography, of course, but it has not to date created a huge reaction with millions of users taking their DNS overseas.
“The scale of the reaction is what we fear,” Kaminsky said. Vixie added: “To the extent that the content is extremely popular the bypass mechanisms will also be popular.”
The measures proposed by Protect IP would also break DNSSEC, but that’s still pretty much pie-in-the-sky stuff, so the press conference did not spend much time focusing on that.

DNS not to blame for Egypt blackout

Egypt got disconnected from the internet last night, but it does not appear that DNS is to blame.
It what appears to be an unprecedented move, internet traffic to and from Egypt dried up to a trickle, apparently as a result of a government effort to crack down on anti-presidential protests.
While a number of reports have blamed DNS for the outage, the currently available data suggests the problem is much more deeply rooted.
Traffic monitoring firm Renesys seems to be one of the best sources of primary data so far. The company’s James Cowie blogged today:

At 22:34 UTC (00:34am local time), Renesys observed the virtually simultaneous withdrawal of all routes to Egyptian networks in the Internet’s global routing table. Approximately 3,500 individual BGP routes were withdrawn, leaving no valid paths by which the rest of the world could continue to exchange Internet traffic with Egypt’s service providers. Virtually all of Egypt’s Internet addresses are now unreachable, worldwide.

BGP is the Border Gateway Protocol. It’s used where networks interconnect, enabling ISPs to “announce” what IP addresses they are responsible for and exchange traffic accordingly.
With no BGP routes into or out of Egypt, whether the DNS works or not is pretty much moot.
Blocking individual domain names, such as twitter.com, is one way to stifle communication. Another way is to instruct local ISPs to turn off DNS altogether.
But in both cases users can route around the blockade by choosing overseas DNS servers, such as the services Google and OpenDNS make available for free.
Even without DNS, users can still access web resources using IP addresses, if they know what they are.
But when ISPs stop announcing their IP addresses, even that becomes impossible. Even if you know how to find a web site, it has no way of finding you.
In this case, it seems likely that Egypt has physically unplugged itself from the global internet, which means its traffic is going nowhere, no matter what protocol you’re talking about.
But even this is not foolproof. According to experts interviewed on BBC news in the last hour, ISPs outside of the country are offering free dial-up access to Egyptians.
Egyptians with access to a dial-up modem, phone jack, compatible computer and long-distance service will presumably be able to use these services to reach the outside world, albeit at 1990s speeds.
With all the inter-governmental debate about the management of domain names over the last several years, the Egypt crisis is a useful reminder that DNS is not the quintessential element of internet governance it is often made out to be.

Symantec gets into the DNS game with Dyn

Symantec has partnered with Dyn to offer a free DNS service to mobile Norton users.
As part of its new mobile strategy, expected to be announced later today, Symantec will provide free DNS resolution with a built-in filter that blocks potentially dangerous domains.
Dyn.com will provide the back-end, which will compete with the likes of OpenDNS and Google’s DNS service.
Non-technical users will be able to download a client application that configures their local DNS to work with the service, which drops one barrier to entry.
Symantec reportedly expects to earn revenue from advertising links – presumably by intercepting NXDOMAIN responses and providing sponsored error pages.
So the deal could be a bit of a money-spinner for Dyn; it’s certainly a further validation of its service.
But is it sexy? Hmm…

German domains see severe downtime

Many domains ending in .de, Germany’s country-code TLD, have seen downtime today, after something went wrong at Denic, the registry manager.
Details are sketchy at the moment, but it appears from chatter on the DNS-Ops mailing list that several instances of the .de zone stopped serving addresses this morning.
It appears that the affected servers were responsible for .de domains beginning with F through Z, so facebook.de would have worked, but heise.de would not.
The German slice of Twitter has been going a bit nuts with comments, and the German press is already on the case.
This is obviously a huge headache if you’re German or do business in Germany — I hate to think how many transactions could have been disrupted by the downtime — and I expect Denic will take a lot of flack at home over the coming days and weeks.
The problem, however, does appear to have been fixed. SANS estimates the outage as a little over an hour.