how to get people to upgrade? (Re: The weak link? DNS)

The ISC would host a zone that would contain TXT records with
security/bug advisories for every version:

I have a better idea.

ISC could set up a web page that would contain security/bug advisories for
every version. In order to make it easier for people to find this web
page, it could be listed in various directories such as CERT. And it could
also be put into search engines so that someone could go to Google, type
in "BIND bug" and click "I'm Feeling Lucky".

yadda yadda yadda...


Let's face it folks, DNS is not the tool of choice for publishing anything
other than the mapping between hostnames and IP addresses.

For some things the web is better. For others LDAP is better. And for the
problem that Paul mentioned at the beginning there is only one solution;
the press.

The fact is that Paul wants to catch the attention of people who aren't
paying attention right now. He has stated that email notices don't work
and we can assume that the BIND security web page, and CERT's web pages
also don't work. No, there is only one thing Paul can do right now.

a. Collect some realistic numbers as to the number of DNS servers that are
vulnerable to the various exploits. Ask people who do network scanning to
provide some statistics on what they see and scale them up according to
the number of hosts in the host-count database. For example, assume that
someone has scanned N hosts and discovers that N/10 are running BIND and
that 40% of those are vulnerable. Also assume that the hostcount shows 20
million hosts in the world. Infer from this that there are 2 million BIND
servers and that there are 800,000 vulnerable ones. But do the
calculations with some real data, not my example figures.

b. Write a press release with the following headline:

      N Thousand Internet Servers Suffer Same Fate as Iraqi Server

Or maybe write some variation on this but keep it scary and keep Iraq in
the headline. The body of the press release should explain the attacks
that the Iraqi server was suffering from, then point out how many other
servers are also vulnerable and then point out how terrorists could use
these vulnerabilities against us. If you can, name some specific
organizations where you know the vulnerability exists. Pick a large
organization or two that has many nameservers and the vulnerability exists
in some obscure corner of the organization, not on their main nameservers.
They really can't sue over this because you haven't damaged them by
disclosing enough detail for an attacker to use.

c. release to both the national press and the computer/network trade

That's how you get people's attention and that's also how the clueful
technical people get the authority and funding to go in and fix the
vulnerable boxes. As long as we continue to play games and pretend that
Internet operations is still the old boys club that it once was, we will
continue to suffer from these nagging issues.

People on the NANOG mailing list do not run the Internet anymore. NANOG's
market share of network operations people has been steadily shrinking as
the Internet has grown. This may still be the moist clueful gathering
place, but there are an awful lot of people out there today designing,
building and operating networks, who have never heard of NANOG.

There is no universal forum anymore. The Internet isn't special anymore.

--Michael Dillon

What are you talking about, DNS check option will work great for BIND,
I mean if BIND can not get to the root server and thereafter to ISC, you
don't have to worry about it getting hacked, its probably not connected to
internet. And dns already provides ability for ISC to have multiple
diverse dns servers in different parts of the world in case you can't get
to one of them, so access to these TXT records is assured.

And I really do like how Jeff finished with good example what I had in
mind in my original email. I still think it might be worth it to ask for
email administrator email address during setup and have that added to
named.conf as its own special parameter and when its not present then
email can go to root or postmaster or possibly hostmaster address from the
first zone listed (I'm not sure which is better...) and this system also
has to be presented to the user (possibly as default on option), but they
must also know what the sytem would be doing (i.e. that you for example
will have list of their ips) as some already expressed privacy concerns on
this being done automaticly without turn-off option.

Keep in mind that the *really* damaging security incidents tend to be the
ones with skilled and/or insider attackers. And if you've scored some
secretary's PC inside the corporate net, a DNS server inside the net
(and unable to contact the outside world) makes a GREAT way to leverage
the foothold....