Slashdot Mirror
Chinese DNS Tampering a Real Threat To Outsiders
Trailrunner7 writes "China has long used the Internet's Domain Name Service to censor Web sites and information that the ruling Communist Party deems threatening. But now security experts warn that the government's censorship is in danger of spilling over China's borders, suppressing the ability of those living outside of China to find information online. An estimated 57% of all networks on Earth passed DNS requests through a Chinese DNS rootserver at some point in 2010, according to data from security firm Renesys. Tampering by the Communist Party there poses a danger to Internet security and freedom. In fact, DNS tampering may be a bigger threat than techniques like BGP (Border Gateway Protocol) hijacking, which is believed to be responsible for an unexpected shift in Internet routing in April that has recently been the subject of mainstream media reports in the US. There is already evidence that China's efforts to tamper with DNS have bled outside the country's borders. The same report to Congress from the US-China Economic and Security Review Commission that called attention to the BGP hijacking incident from April, 2010 also mentions a March, 2010 incident in which Internet users in the US and Chile attempted to connect to social networking websites banned by the Chinese government. However, their DNS requests were handled by a Beijing-based Domain Name Server, which responded with incorrect DNS information that directed the surfers to incorrect servers, the report says."
...DNS routes you! Oh, wait...
I understand the need for mass replication of the DNS root servers and appreciate both the cultural and technical needs to spread them fairly evenly throughout the world but is it really necessary for China to replicate F, I and J at the root level? Would performance and the world perception of a US controlled internet really suffer if China was denied access to the root level? Let them replicate all 13 for their internal use but remove any server's root status if the server is hosted in China... Maybe I'm missing something here but is this not a reasonable stance on preventing this type of collateral damage?
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
DNSSEC. Get on it.
SIG: HUP
u.s. just grabbed 12 domain names, on the whim of some private interests inside usa. not only that they dropped an 'for other purposes' clause, in the bill/whatever that is going to allow them to do more.
'for other purposes'. you can even put 'daydreaming' in it, and legally grap domains that help people daydream.
Read radical news here
The United States government has already stolen domain names without due process. They don't even have jurisdiction over some of them.
http://yro.slashdot.org/story/10/11/27/1910232/DHS-Seizes-75-Domain-Names
At what point are we going to get sick enough of this garbage to just completely segregate China from the rest of the internet?
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Why do we have it then? AFAIK root zone was signed in May, so just don't send those super secret root zone KSKs to red commies and every validating resolver is safe!
Hooray for advanced protocol beating the red threat back!
Just this past week the US government seized 75+ domains without any notice. Is this any different?
Since Chinese control 3 of the root DNS servers, I bet they are given the root zone KSKs.. and with them, you can spoof any record.
If only you could mod servers up or down, giving them some sort of reputation history. The your OS could determine a trusted anchor based on a server's "karma" and your requirements*. A system parallel to DNSSEC for apportioning, updating, and validating trust.
* yeah, I'm borrowing Slashdot terminology. But what the heck, it kind of works.
The world is made by those who show up for the job.
(tl;dr version)
Big Threat Internet Security
China censor Web sites and information ruling Communist Party threatening security experts warn government's censorship danger spilling China's suppressing China Chinese Tampering Communist Party danger security and freedom tampering bigger threat hijacking unexpected China's tamper bled
U.S.-China Economic and Security Review Commission hijacking incident incident.
(And when I count to three you will awaken and be VERY AFRAID).
"Kill 'em all and let Root sort 'em out"
Comparing the US and China as far as the Internet goes kind of indicates who the asshat is here.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Root servers point to top-level domains. com, net, org, cn, us, uk... these would all have their own keys. China would only have access to one of those. As pointed out by others, the roots are pre-signed and just passed around for mirroring.
This doesn't prevent China from doing various nuisance activities such as replying with unresolvable, bogus unsigned answers, or bogus answers with wrong signers. That said, you'd at least have some level of verification available that a DNSSEC signed answer is appropriate, and you could ignore anything but.
SIG: HUP