Skip to Content

AOL Tech

dns posts

Computers, Web

Typo Takes Out Internet for Swedes

Monday night, all of Sweden lost access to the Internet, thanks to a problem that arose during routine maintenance of the country's top-level domain, .se (like .com or .us in the U.S.).

The root of the issue was an improperly configured script (or set of commands) used to update the .se zone. When Sweden's Internet Infrastructure Foundation investigated the cause, it found that the error in the configuration was a simple typo; someone had left a period off the end of a DNS record. DNS is the system responsible for turning Web names like Switched.com into a machine-readable IP address.

Read more →

Computers

Hackers Release Tools to Access Secure Online Transactions

Hackers Release Tools to Exploit SSL FlawRemember that massive Internet addressing flaw that broke late last summer? The one that has the potential to let any malicious hacker out there intercept traffic to any site and, more dangerously, pose as any official site? Well, it's been patched by most, but some are a little slow on the draw, and an attendee to the Black Hat security conference has indicated he is releasing a tool that should make attacking the exploit painfully easy.

The hacker goes by the name Moxie Marlinspike and is planning to release a tool called SSLstrip, named after SSL. It would allow malicious hackers to quickly and easily capture network traffic and intercept supposedly secure transactions, such as the kind you conduct with your bank or if you're buying something online. With this in place a hacker could capture your bank account number, username and password, credit card numbers, and all manners of sensitive information.

The only catch (for Moxie and other hackers) is that the browser padlock graphic, which typically pops up on your web browser indicates a secure connection, is absent when this software is attacking a user's connections, meaning a user who is paying attention might just notice the flaw. It's unlikely this attack will become too common, but, regardless, it serves as a reminder to look for that padlock whenever doing anything that calls for a secure connection. [From: Forbes]

Related Links:

Computers

Internet Addressing Flaw Fears Extend to E-Mail, Other Online Services

Internet Addressing Flaw Fears Extend to E-Mail, Other Online Services
Remember that ugly flaw in Internet addressing, or DNS, which was detected and fixed, but not by everyone and not in time? The man behind many of those warnings, security expert Dean Kaminsky, recently gave a presentation at the Black Hat conference in Las Vegas, elaborating on how the flaw not only affects Web pages, which has been most commonly reported on, but also could allow hackers to take over e-mail and FTP addresses, as well as other common online communication protocols.

Kaminsky even indicated that the Secure Socket Layer, or SSL, is also vulnerable. SSL certificates are what results in the "key" being displayed when you're shopping at a secure site, indicating to you that your data is being encrypted and secured as it travels over the wire. Not everyone is so concerned, however. VeriSign, one of the leaders in SSL certificates, is playing down those fears. A representative indicated that the company has known of this flaw for "many years" and has "basically engineered around [it]."

Why the company didn't bother to tell anyone else remains to be seen. Way to be a team player there, VeriSign. [Source: CNN, and BBC News]

Computers

Experts Fear Internet Addressing Flaw Already Being Exploited

Experts Fear Internet Addressing Flaw Already Being Exploited

Remember that major DNS flaw we reported about a few weeks back? The one that was patched before it was announced but attacks were feared anyway because some folks are slow to update (or patch) their systems? Well, not one but two separate means for exploiting the flaw have been discovered, and one has already been added to an incredibly popular suite of hacking tools, leading one security expert to believe attacks have already begun.

Dan Kaminsky, a security expert and the guy to originally discover the flaw, believes attacks are happening now. "This attack is very good. [It] is being weaponised out in the field. Everyone needs to patch, please." He's urging network administrators and IT personnel everywhere to upgrade their systems to prevent this flaw, which could allow hackers to redirect traffic meant to go to banks and other secure online sites to anywhere they like.

It's a big step beyond the typical phishing attack, where scammers try to get you to click on a link on a site that looks like the real thing. If those phishers were using this exploit there would be no easy way for you to tell the site you were typing your password into is the real thing! Again, the patch is out there, so hopefully major sites have been fixed, but still it wouldn't hurt to be a little extra cautious for awhile before typing in your info. [Source: BBC News]

Computers

Hack Attacks Likely Following Internet Addressing Flaw

Details of Internet Addressing Flaw Accidentally Released, Hackers Rejoyce

Remember that major flaw announced earlier this month in DNS, the Domain Name System responsible for getting your browser from a URL like www.switched.com to the actual computer that hosts it? Well, fixes were released for the problem before the details of the issue were widely known, and the hope had been to keep those details under wraps for another month or so to give time for Internet administrators to install those fixes. Well, oops, the details were accidentally leaked yesterday, and security experts are now saying to get ready for a flood of attacks.

The flaw could allow hackers and phishers to make any Web site not only look like another page, but actually be served up when you type in the correct address, leaving you with no way to know the site is fake before entering your login information.

Though fixes for the flaw have been released, as usual, it will take some time before they're installed on servers around the world, leaving many sites still vulnerable. Unfortunately, there's not much you can do except hope that banks and other major sites are keeping ahead of the hackers on this one -- something they've certainly failed to do in the past. [Source: PC World]

Computers

Major Flaw in Internet Addressing Discovered, Fixed



When you type a URL (say, switched.com) into a browser, a whole series of operations take place in the background to navigate your request through the maze of the Internet, ultimately getting it to the set of computers that host this site. That process of identifying servers by name is called the Domain Name System, or DNS, and it's fundamental to the entirety of the 'Net. A few months ago, however, security experts found a flaw in the core of DNS that could allow malicious users to make any site they want look like any other site, and we're only hearing about it now.

The flaw would basically allow anyone to redirect a URL to a private computer. They could take over the URL for your bank or e-mail account, put up a page that looked exactly like the real thing, then steal your username and password when you tried to log in. There'd be no way to know that it wasn't the real thing until it was too late. Scary? Yes, and that's exactly why experts from every major provider of software that provides DNS services have worked together in secret for months to implement the fix, which was finally released yesterday.

This doesn't mean that we're completely out of the water, as certain system administrators are occasionally a bit lax in updating their machines, but hopefully by the time you read this, the major sites will all have been updated, meaning you can go back to your idle and carefree surfing again. [Source: Yahoo! News]

Computers, Advice

New Malware Can Alter Your Wireless (Wi-Fi) Router and Steal Your Info

Zlob, one of the most common pieces of malicious software (according to Microsoft), has undergone a frightening transformation. After infecting a victim's PC, Zlob checks to see if the computer is connected to a wireless router (the device that helps create the Wi-Fi hotspot in your house). If connected, then Zlob attempts to gain access by using a list of common and default username and password combinations.

Assuming Zlob gains access to the router, the software then changes the DNS settings on the router to send all traffic through a hackers' servers first. DNS servers act like a phone book for the Internet, connecting the user readable addresses like Switched.com to the IP addresses that are understood by computers.

Unfortunately, most people don't bother changing the default password on their routers, thus making it easier for Zlob to infiltrate computer networks and potentially steal personal data and information.

Avoiding being beaten by this attack is relatively easy. First, set up proper security software on your PC (anti-virus and a firewall) and keep it up to date. Second, always change the default administrator passwords on your equipment, especially your router. If an attacker is able to gain access to your router, it can access your entire computer network. [Source: Washington Post]

Switched Video

Follow Switched on Twitter

Deals of the Day

Latest Reviews from CNET.com

CNET provides the latest tech news, unbiased reviews, videos, podcasts, software, and downloads, making tech products easy to find, understand and use.

Top Product Reviews

  • Home Audio Reviews

    9.0 out of 10

    Definitive Technology BPX
    Works great with Dolby Pro Logic and Dolby Digital. Full Review

    8.8 out of 10

    KEF KHT3005 (black)
    The KEF KHT-3005 is one compact, beautifully designed speaker package with solid aluminum satellites that feature unique driver technology to produce incredible clarity. Meanwhile, the equally astounding dual 10-inch, 250-watt powered subwoofer delivers ultradeep bass. Full Review

    8.8 out of 10

    KEF KHT3005 (silver)
    The KEF KHT-3005 is one compact, beautifully designed speaker package with solid aluminum satellites that feature unique driver technology to produce incredible clarity. Meanwhile, the equally astounding dual 10-inch, 250-watt powered subwoofer delivers ultradeep bass. Full Review

  • Cell Phone Reviews

    8.7 out of 10

    SignalBoost Mobile Professional Amplifier Kit
    The Mobile Professional Amplifier delivers a powerful signal boost to your cell phone. Also, it offers a compact design and easy setup. Full Review

    8.6 out of 10

    Wi-Ex zBoost YX510-PCS-CEL cell phone signal extender
    The Wi-Ex zBoost YX510-PCS-CEL significantly boosts your cell phone reception and is easy to operate. Also, it uses a wireless connection to your phone. Full Review

    8.3 out of 10

    LG VX6000 (Verizon Wireless)
    Compact and stylish; impressive battery life; solid audio quality; sharp color screen; built-in camera; USB ready; affordable. Full Review

  • Digital Camera Reviews

    9.3 out of 10

    Canon EOS 1D Mark III
    Extremely fast, 10-megapixel continuous shooting; very low noise; highly customizable; well-designed body with weather sealing; 3-inch LCD; abundant optional accessories. Full Review

    9.3 out of 10

    Nikon D3 (body only)
    Full-frame sensor; well designed, pro-level weather-sealed body; very low noise, even at extremely high ISOs; fast. Full Review

    9.0 out of 10

    Canon EOS-1Ds Mark III
    Very low noise, high quality images; 21.1 megapixels; live view shooting; pro-level build-quality and performance. Full Review

  • Desktop Reviews

    8.9 out of 10

    Velocity Micro Edge Z30 (Intel Core i7)
    Best value among midrange gaming PCs; Velocity Micro's consistently high build quality; compact case makes few sacrifices; second graphics card slot previously uncommon at this price. Full Review

    8.5 out of 10

    Apple iMac (24-inch, 2.8GHz)
    A minor specification update results in some significant performance gains; graphics upgrade an option on this 24-inch model; sleek, polished design didn't receive an update, but we won't start clamoring for a new design until the current one is at least 12 months old. Full Review

Featured Galleries

Nissan Land Glider
Vintage Keyboards
Retro Computer Logos
Vintage Computer Festival
Motorola CLIQ
iPod touch
iTunes 9
Video iPod Nano
The Beatles: Rock Band

 

Switched Desktop

Get the New Switched Desktop

Latest tech news, Switched mail, and more.

AOL Tech Network

Resources

Autoblog

Daily Finance

Download Squad

Engadget

Joystiq

Urlesque

Fanhouse Main

WalletPop

Gadling