http://www.theregister.co.uk/2008/07/25/isps_slow_to_patch/
By Dan Goodin in San Francisco
The Register
25th July 2008
More than two weeks after security researchers warned of a critical
defect in the net's address lookup system, some of the world's biggest
internet service providers - including AT&T, BT, Time Warner and Bell
Canada - have yet to install a patch inoculating their subscribers
against attacks.
According to an informal survey of Register readers, 15 ISPs failed the
"Check my DNS" [1] test (see button to the right) on the website of
researcher Dan Kaminsky, who discovered the bug. Now that attack code
exploiting the vulnerability has been leaked into the wild [2], millions
of subscribers are at risk of being silently redirected to impostor
sites that try to install malware or steal sensitive information.
Comcast and Plusnet were the only two ISPs we found that weren't
vulnerable.
The lack of action comes after Kaminsky, domain name resolution guru
Paul Vixie and others have repeatedly warned that the vulnerability has
the potential to wreak havoc on the net. Their advisories became more
urgent following the leaking of the vulnerability details, which
Kaminsky intended to keep private until next month's Black Hat
conference in Las Vegas.
[1] http://www.doxpara.com/
[2] http://www.theregister.co.uk/2008/07/24/dns_exploit_goes_wild/
[...]
Received on Fri Jul 25 07:36:57 2008