{"id":4606,"date":"2011-11-07T11:40:16","date_gmt":"2011-11-07T19:40:16","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=4606"},"modified":"2020-05-06T10:31:44","modified_gmt":"2020-05-06T17:31:44","slug":"if-you-cant-trust-your-isp-who-can-you-trust","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/","title":{"rendered":"If You Can’t Trust Your ISP, Who Can You Trust?"},"content":{"rendered":"

Apparently\u00a0there’s a “massive” attack against DNS infrastructure underway in Brazil<\/a>. Much of the initial reporting refers to the attack as cache poisoning, though\u00a0Rod Rasmussen correctly points out that it’s not “classic cache poisoning”<\/a>: the culprits allegedly worked at a Brazilian ISP and used default passwords to change the DNS settingson customer premises equipment, and modified the configurations of the ISP’s recursive name servers to direct customers to bogus sites. (“Classic” cache poisoning attacks, of course, require no such special access to resolver or name server configuration to carry out.)<\/p>\n

Besides raising the upsetting specter of collusion by the employees of ISPs, this threat brings us back to\u00a0DNSSEC’s “last mile” problem<\/a>. While this would seem like a textbook example of the kind of threat DNSSEC\u00a0should<\/em>\u00a0protect against, in fact DNSSEC wouldn’t have been much help to most of the ISP’s subscribers. Without a secure channel between a stub resolver, like the one on the laptop I’m typing on, and the local recursive name server, there’s no foolproof way of determining that your name server has been replaced.<\/p>\n

Even if the channel between the stub resolver and the recursive name server is secure, if you can’t trust the name server on the other end, you’re sunk. Stub resolversrely on their local recursive name server to perform DNSSEC validation in most cases. So my Mac is at the mercy of the recursive name server this Parisian hotel’s WiFi network uses (wherever that is). If the name server claims to have validated a set of resource records using DNSSEC, my laptop believes it. If the ISP operating that name server tampers with its configuration to send bogus responses, I’ll believe that’s valid data.<\/p>\n

The only way DNSSEC could have helped the victims of the attack, in fact, is if they’d run their own validating name server locally, or if they’d used a set of recursive name servers provided by someone other than the ISP through a secure channel. And not many subscribers are technically adept enough to do either.<\/p>\n

Maybe it’s worth considering embedding a simple validating recursive name server in most operating systems so we aren’t forced to rely on our ISPs to protect us. Most modern computers have the resources to support a name server. (Heck, some phones probably have the resources.) The real burden, in my opinion, is the hassle of administering it.<\/p>\n","protected":false},"excerpt":{"rendered":"

Apparently\u00a0there’s a “massive” attack against DNS infrastructure underway in Brazil. Much of the initial reporting refers to the attack as cache poisoning, though\u00a0Rod Rasmussen correctly points out that it’s not “classic cache poisoning”: the culprits allegedly worked at a Brazilian ISP and used default passwords to change the DNS settingson customer premises equipment, and modified […]<\/p>\n","protected":false},"author":178,"featured_media":2544,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[2],"tags":[30,16,212,15],"class_list":{"0":"post-4606","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security","8":"tag-dns","9":"tag-infoblox","10":"tag-isp","11":"tag-security","12":"entry"},"acf":[],"yoast_head":"\nIf You Can't Trust Your ISP, Who Can You Trust?<\/title>\n<meta name=\"description\" content=\"Apparently there's a "massive" attack against DNS infrastructure underway in Brazil.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"If You Can't Trust Your ISP, Who Can You Trust?\" \/>\n<meta property=\"og:description\" content=\"Apparently there's a "massive" attack against DNS infrastructure underway in Brazil.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2011-11-07T19:40:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-05-06T17:31:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ThinkstockPhotos-511475207-1-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"454\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Cricket Liu\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Cricket Liu\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/\"},\"author\":{\"name\":\"Cricket Liu\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb6b62b1b99a7cbcd7c528d5763778d5\"},\"headline\":\"If You Can’t Trust Your ISP, Who Can You Trust?\",\"datePublished\":\"2011-11-07T19:40:16+00:00\",\"dateModified\":\"2020-05-06T17:31:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/\"},\"wordCount\":424,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ThinkstockPhotos-511475207-1-1.jpg\",\"keywords\":[\"DNS\",\"Infoblox\",\"ISP\",\"Security\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/\",\"name\":\"If You Can't Trust Your ISP, Who Can You Trust?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ThinkstockPhotos-511475207-1-1.jpg\",\"datePublished\":\"2011-11-07T19:40:16+00:00\",\"dateModified\":\"2020-05-06T17:31:44+00:00\",\"description\":\"Apparently there's a \\\"massive\\\" attack against DNS infrastructure underway in Brazil.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ThinkstockPhotos-511475207-1-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ThinkstockPhotos-511475207-1-1.jpg\",\"width\":660,\"height\":454,\"caption\":\"Security Tools are Enough to Rapidly Respond to Threats. Think Again!\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/security\\\/if-you-cant-trust-your-isp-who-can-you-trust\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/security\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"If You Can’t Trust Your ISP, Who Can You Trust?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/bb6b62b1b99a7cbcd7c528d5763778d5\",\"name\":\"Cricket Liu\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/cricket-new-96x96.jpg\",\"url\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/cricket-new-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/cricket-new-96x96.jpg\",\"caption\":\"Cricket Liu\"},\"description\":\"Cricket is one of the world\u2019s leading experts on the Domain Name System (DNS) and serves as the liaison between Infoblox and the DNS community. Before joining Infoblox, he founded an internet consulting and training company, Acme Byte & Wire, after running the hp.com domain at Hewlett-Packard. Cricket is a prolific speaker and author, having written a number of books including \u201cDNS and BIND,\u201d one of the most widely used references in the field, now in its fifth edition.\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/cricket-liu\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"If You Can't Trust Your ISP, Who Can You Trust?","description":"Apparently there's a \"massive\" attack against DNS infrastructure underway in Brazil.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/","og_locale":"en_US","og_type":"article","og_title":"If You Can't Trust Your ISP, Who Can You Trust?","og_description":"Apparently there's a \"massive\" attack against DNS infrastructure underway in Brazil.","og_url":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/","og_site_name":"Infoblox Blog","article_published_time":"2011-11-07T19:40:16+00:00","article_modified_time":"2020-05-06T17:31:44+00:00","og_image":[{"width":660,"height":454,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ThinkstockPhotos-511475207-1-1.jpg","type":"image\/jpeg"}],"author":"Cricket Liu","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Cricket Liu","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/"},"author":{"name":"Cricket Liu","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/bb6b62b1b99a7cbcd7c528d5763778d5"},"headline":"If You Can’t Trust Your ISP, Who Can You Trust?","datePublished":"2011-11-07T19:40:16+00:00","dateModified":"2020-05-06T17:31:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/"},"wordCount":424,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ThinkstockPhotos-511475207-1-1.jpg","keywords":["DNS","Infoblox","ISP","Security"],"articleSection":["Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/","url":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/","name":"If You Can't Trust Your ISP, Who Can You Trust?","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ThinkstockPhotos-511475207-1-1.jpg","datePublished":"2011-11-07T19:40:16+00:00","dateModified":"2020-05-06T17:31:44+00:00","description":"Apparently there's a \"massive\" attack against DNS infrastructure underway in Brazil.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ThinkstockPhotos-511475207-1-1.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ThinkstockPhotos-511475207-1-1.jpg","width":660,"height":454,"caption":"Security Tools are Enough to Rapidly Respond to Threats. Think Again!"},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/security\/if-you-cant-trust-your-isp-who-can-you-trust\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.infoblox.com\/blog\/category\/security\/"},{"@type":"ListItem","position":3,"name":"If You Can’t Trust Your ISP, Who Can You Trust?"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/bb6b62b1b99a7cbcd7c528d5763778d5","name":"Cricket Liu","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/cricket-new-96x96.jpg","url":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/cricket-new-96x96.jpg","contentUrl":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/cricket-new-96x96.jpg","caption":"Cricket Liu"},"description":"Cricket is one of the world\u2019s leading experts on the Domain Name System (DNS) and serves as the liaison between Infoblox and the DNS community. Before joining Infoblox, he founded an internet consulting and training company, Acme Byte & Wire, after running the hp.com domain at Hewlett-Packard. Cricket is a prolific speaker and author, having written a number of books including \u201cDNS and BIND,\u201d one of the most widely used references in the field, now in its fifth edition.","url":"https:\/\/www.infoblox.com\/blog\/author\/cricket-liu\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/4606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/178"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=4606"}],"version-history":[{"count":1,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/4606\/revisions"}],"predecessor-version":[{"id":4607,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/4606\/revisions\/4607"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/2544"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=4606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=4606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=4606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}