Security Breach

Computer hackers: Internet flaw sparks biggest security fix in web history

A flaw in the way the internet works has prompted the "largest security update" in the history of the web, and fears of millions of people remaining exposed to criminals and malicious hackers.

Microsoft was among net companies yesterday which announced action to close the loophole that has potentially affected every site on the web.

The bug was spotted this year by Dan Kaminsky, a director at the American security specialist IOActive, who immediately contacted big technology firms to alert them to the problem.

The scam involved hijacking internet addresses and sending surfers to websites other than those they intended to see. By this route criminals stood the chance of tricking victims into handing over personal details or making payments to the wrong people.

Details of the bug, which uses a technique known as "cache poisoning", have not been made public. The idea is to let firms find a solution before hackers learn how to exploit the situation further.

"Computers use the equivalent of address books to figure out where they need to go on the web. This attack could compromise that by attacking the servers that give out the addresses," said Rich Mogull, of the US-based firm Securosis.

Although there is no evidence of the bug being exploited by hackers, news of the flaw drew an unprecedented response from the technology industry. Large companies, including Microsoft and Cisco Systems, scrambled to fix the problem.

"This is the largest synchronised security update in the history of the internet," said Kaminsky. "The severity of this bug is shown by the number of those who are on board with patches."

As fixing the problem is largely the duty of those who operate the millions of web servers, which hold all the information on the internet, rather than those who use the web, most computer users will not have to do anything.

However, a failure to update software could mean surfers still being at risk. And the fixes may not make things entirely safe. The US Computer Emergency Readiness Team, an American agency which deals with security breaches, said that even the changes put forward by Microsoft and others would not remove all possibilities of a hijack. "It is important to note that without changes to the DNS [domain name system] protocol these mitigations cannot completely prevent cache poisoning," said the agency on its website. A flaw in the way the internet works has prompted the "largest security update" in the history of the web, and fears of mill... more

bansheewail

added this