| Dan Kaminsky | |
| Birth Name: | Daniel Kaminsky |
| Birth Date: | 7 February 1979 |
| Birth Place: | San Francisco, California, U.S. |
| Death Place: | San Francisco, California, U.S. |
| Known For: | Discovering the 2008 DNS cache poisoning vulnerability |
| Occupation: | Computer security researcher |
| Alma Mater: | Santa Clara University |
Daniel Kaminsky (February 7, 1979 – April 23, 2021) was an American computer security researcher. He was a co-founder and chief scientist of Human Security (formerly White Ops), a computer security company. He previously worked for Cisco, Avaya, and IOActive, where he was the director of penetration testing.[1] [2] The New York Times labeled Kaminsky an "Internet security savior" and "a digital Paul Revere".
Kaminsky was known among computer security experts for his work on DNS cache poisoning, for showing that the Sony rootkit had infected at least 568,000 computers,[3] and for his talks at the Black Hat Briefings.[2] On June 16, 2010, he was named by ICANN as one of the Trusted Community Representatives for the DNSSEC root.[4]
Daniel Kaminsky was born in San Francisco on February 7, 1979, to Marshall Kaminsky and Trudy Maurer. His mother told The New York Times that after his father bought him a RadioShack computer at age four, Kaminsky had taught himself to code by age five. At 11, his mother received a call from a government security administrator who told her that Kaminsky had used penetration testing to intrude into military computers, and that the family's Internet would be cut off. His mother responded by saying if their access was cut, she would take out an advertisement in the San Francisco Chronicle to publicize the fact that an 11-year-old could break military computer security. Instead, a three-day Internet "timeout" for Kaminsky was negotiated. In 2008, after Kaminsky found and coordinated a fix for a fundamental DNS flaw, he was approached by the administrator, who thanked him and asked to be introduced to his mother.[5]
Kaminsky attended St. Ignatius College Preparatory and Santa Clara University.[6] After graduating from college, he worked for Cisco, Avaya, and IOActive, before founding his own firm White Ops (later renamed Human Security).
During the Sony BMG copy protection rootkit scandal, where Sony BMG was found to be covertly installing anti-piracy software onto PCs, Kaminsky used DNS cache snooping to discover whether servers had recently contacted any of the domains accessed by the Sony rootkit. He used this technique to estimate that there were at least 568,000 networks that had computers with the rootkit.[3] Kaminsky then used his research to bring more awareness to the issue while Sony executives were trying to play it down.
In April 2008, Kaminsky realized a growing practice among ISPs potentially represented a security vulnerability.[7] Various ISPs have experimented with intercepting return messages of non-existent domain names and replacing them with advertising content. This could allow hackers to set up phishing schemes by attacking the server responsible for the advertisements and linking to non-existent subdomains of the targeted websites. Kaminsky demonstrated this process by setting up Rickrolls on Facebook and PayPal.[1] [8] While the vulnerability used initially depended in part on the fact that Earthlink was using Barefruit to provide its advertising, Kaminsky was able to generalize the vulnerability to attack Verizon by attacking its ad provider, Paxfire.[9]
Kaminsky went public after working with the ad networks in question to eliminate the immediate cross-site scripting vulnerability.[10]
In 2008, Kaminsky discovered a fundamental flaw in the Domain Name System (DNS) protocol that could allow attackers to easily perform cache poisoning attacks on most nameservers[11] [12] (djbdns, PowerDNS, MaraDNS, Secure64 and Unbound were not vulnerable).[13] [14] [15] [16] With most Internet-based applications depending on DNS to locate their peers, a wide range of attacks became feasible, including website impersonation, email interception, and authentication bypass via the "Forgot My Password" feature on many popular websites.[17] [18] After discovering the problem, Kaminsky initially contacted Paul Vixie, who described the severity of the issue as meaning "everything in the digital universe was going to have to get patched." Kaminsky then alerted the Department of Homeland Security and executives at Cisco and Microsoft to work on a fix.
Kaminsky worked with DNS vendors in secret to develop a patch to make exploiting the vulnerability more difficult, releasing it on July 8, 2008.[19]
Kaminsky had intended not to publicize details of the attack until 30 days after the release of the patch, but details were leaked on July 21, 2008.[20] The information was quickly pulled down, but not before it had been mirrored by others.[21] He later presented his findings at the Black Hat Briefings, at which he wore both a suit and rollerskates.
Kaminsky received a substantial amount of mainstream press after disclosing this vulnerability,[22] but experienced some backlash from the computer security community for not immediately disclosing his attack.[23] When a reporter asked him why he had not used the DNS flaw for his own financial benefit, Kaminsky responded that he felt it would be morally wrong, and he did not wish for his mother to visit him in prison.
The actual vulnerability was related to DNS only having 65,536 possible transaction IDs, a number small enough to simply guess given enough opportunities. Dan Bernstein, author of djbdns, had reported this as early as 1999.[24] djbdns dealt with the issue using Source Port Randomization, in which the UDP port was used as a second transaction identifier, thus raising the possible ID count into the billions. Other more popular name server implementations left the issue unresolved due to concerns about performance and stability, as many operating system kernels simply weren't designed to cycle through thousands of network sockets a second. Instead, other implementers assumed that DNS's time to live (TTL) field would limit a guesser to only a few attempts a day.[25]
Kaminsky's attack bypassed this TTL defense by targeting "sibling" names like "83.example.com" instead of "www.example.com" directly. Because the name was unique, it had no entry in the cache, and thus no TTL. But because the name was a sibling, the transaction-ID guessing spoofed response could not only include information for itself, but for the target as well. By using many "sibling" names in a row, he could induce a DNS server to make many requests at once. This tactic provided enough opportunities to guess the transaction ID to successfully spoof a reply in a reasonable amount of time.[26]
To fix this issue, all major DNS servers implemented Source Port Randomization, as djbdns and PowerDNS had done before. This fix makes the attack up to 65,536 times harder. An attacker willing to send billions of packets can still corrupt names. DNSSEC, which Kaminsky spoke in favor of, has since been widely (but not universally) deployed, bringing cryptographic assurance to results provided by DNS.[27]
On March 27, 2009, Kaminsky discovered that Conficker-infected hosts have a detectable signature when scanned remotely.[28] Signature updates for a number of network scanning applications are now available, including NMap[29] and Nessus.[30]
In 2009, in cooperation with Meredith L. Patterson and Len Sassaman, Kaminsky discovered numerous flaws in the SSL protocol. These include the use of the weak MD2 hash function by Verisign in one of their root certificates and errors in the certificate parsers in a number of Web browsers that allow attackers to successfully request certificates for sites they do not control.[31] [32]
On July 28, 2009, Kaminsky, along with several other high-profile security consultants, experienced the publication of their personal email and server data by hackers associated with the "Zero for 0wned" online magazine.[33] [34] [35] The attack appeared to be designed to coincide with Kaminsky's appearance at the Black Hat Briefings.[36]
In June 2010, Kaminsky released Interpolique,[37] [38] a beta framework for addressing injection attacks such as SQL injection and cross-site scripting in a manner comfortable to developers.[39]
The New York Times wrote that "in a community known for its biting, sometimes misogynistic discourse on Twitter, Mr. Kaminsky stood out for his empathy." He was known for regularly paying for hotels or travel bills for other people going to Black Hat, and once paid for a plane ticket for a friend of his after she had broken up with her boyfriend; the pair later married. At various points in his career, Kaminsky shifted his focus to work on projects related to his friends' and family's health, developing an app that helps colorblind people, working on hearing aid technology, and developing telemedicine tools related to AIDS among refugees for Academic Model Providing Access to Healthcare (AMPATH). According to his mother, "he did things because they were the right thing to do, not because they would elicit financial gain."
Kaminsky was also an outspoken privacy rights advocate. During the FBI–Apple encryption dispute, he criticized comments by then-FBI director James Comey, saying "what is the policy of the United States right now? Is it to make things more secure or to make them less secure?" In a 2016 interview, Kaminsky said, "the Internet was never designed to be secure. The Internet was designed to move pictures of cats ... We didn’t think you’d be moving trillions of dollars onto this. What are we going to do? And here’s the answer: Some of us got to go out and fix it."
Kaminsky died on April 23, 2021, of diabetic ketoacidosis at his home in San Francisco.[40] [41] He had been frequently hospitalized for the disease in prior years. After his death, he received tributes from the Electronic Frontier Foundation, which called him a "friend of freedom and embodiment of the true hacker spirit", and from Jeff Moss, who said Kaminsky should be in the Internet Hall of Fame. On December 14, 2021, that wish came to fruition.[42]