April 1 has turned into a certifiable day of lunacy for Internet pranksters, with even major companies like Google and Whole Foods Market getting in on the act with fake product announcements and features designed to make people grin. This year was promising to be a little different—at least according to mainstream media outlets—because the dreaded Conficker worm was schedule to “phone home” and receive new instructions on how to wreak havoc on the Internet and Web sites all around the world. But now it’s April 2, and the Conficker threat has largely failed to materialize.
Tag Archive: Dan Kaminsky
Problems With DNS Flaw Patches
The Domain Name System (DNS) flaw discovered by Dan Kaminsky appeared to have been patched, thanks to some rare industry-wide co-operation. But, it seems, that might not be quite the case.
ZDNet has reported that security company nCircle has reported problems with the Apple fix for its OS X operating systems, as it fails to randomize ports for client libraries. Their director of security operations, Andrew Storm, blogged:
DNS Exploit Flaw Arrives
Not long ago security research Dan Kaminsky revealed a flaw in the Domain Name System (DNS), although he refused to give details. Those came, somewhat inadvertently, thanks to another researcher, Halvar Flake.
Now, inevitably, the first exploit code for that flaw has arrived.
Luckily, it’s been created by two other researchers, HD Moore and Druid, who’ve developed an exploit module that runs that Moore’s vulnerability-testing framework, Metasploit, according to Vnunet.
Kaminsky had refused to give details of the flaw until a solution had been developed, and that was followed by a massive patch rollout, so many servers are already patched against any potential attack.
DNS Security Patch Released
A security patch has been released for a dangerous error we didn’t even known existed.
The BBC reports that about six months ago security expert Dan Kaminsky discovered an error in the Domain Name System (DNS), under which criminals could redirect people to fake web pages, even if they’d typed the correct name.
The DNS converts the words typed into a numerical address that’s used to route all Internet traffic.
Exploiting an error like that would make phishing scams simple – people would think they were at their bank website and happily type in personal details, which the criminals could then harvest.


