WE DO ASCII

Detox: sys4 and BSI make DNS more secure

The vulnerability of the Domain Name System may come across as astonishing. Of course, this vulnerability was never the intention of the DNS’s inventors, and it can be seen as an expression of the innocence of a bygone era.

There are many ways to manipulate the DNS. One notorious method is what is known as DNS cache poisoning. This involves manipulating entries in the DNS in order to misdirect address queries.

The attack vector has been known since 2013. Appropriate name server patches temporarily gave cause for hope that the problem had been eliminated. However, it quickly became clear that DNS cache poisoning is still taking place. On behalf of the German Federal Office for Information Security (BSI), sys4 investigated the extent of the problem and what can act as an antidote. In the process, sys4 identified an effective measure to immunize the DNS against cache poisoning: Limiting DNS responses via the User Datagram Protocol (UDP) to a maximum size of 1232 bytes.

Getting the dose right: Gradually dispensing email authentication

Email authentication with SPF, DKIM and DMARC is a powerful tool in the fight against phishing and spammers. Those who opt for this trinity strengthen their reputation and their ability to act on the Internet – as long as its introduction in production is done with the necessary caution.

Those who act too rashly run the risk of inadvertently strangulating their company's email communications. The precisely orchestrated staging of SPF, DKIM and DMARC is a necessary condition for success. The policy must be made progressively more stringent.

This often reveals things that were previously in the shadows – at least from the IT perspective. A classic example is the server on which half-forgotten email forms are running. Or external mailing lists, used by colleagues in the company, where contributions are forwarded using their sender addresses. Or: The external email marketing platform used by the marketing department without the knowledge of the IT department.