[AfrICANN-discuss] DNS Survey Results Pandora's Box of Both Frightening and Hopeful Results, Says Cricket Liu

[Anne-Rachel Inné]

 DNS Survey Results Pandora's Box of Both Frightening and Hopeful Results,
Says Cricket Liu<http://www.circleid.com/posts/dns_survey_results_pandora_box_of_both_frightening_and_hopeful_results/>


   http://www.circleid.com/posts/print/dns_survey_results_pandora_box_of_both_frightening_and_hopeful_results/


   <http://www.circleid.com/posts/print/dns_survey_results_pandora_box_of_both_frightening_and_hopeful_results/>
   - Nov 16, 2009 3:23 PM PST
   - Comments: 0<http://www.circleid.com/posts/print/dns_survey_results_pandora_box_of_both_frightening_and_hopeful_results/#comments>
   - Views: 303

By *CircleID Reporter* <http://www.circleid.com/members/501/>

The fifth-annual survey of domain name servers (DNS) on the public
Internet—called a "Pandora's box of both frightening and hopeful
results"—was released today by The Measurement
Factory<http://www.measurement-factory.com/> in
partnership with Infoblox. Cricket Liu, Vice President of Architecture at
Infoblox and author of O'Reilly & Associates' DNS and BIND, DNS & BIND
Cookbook says: "Of particular interest is the enormous growth in the number
of Internet-connected name servers, largely attributable to the introduction
by carriers of customer premises equipment (CPE) with embedded DNS
functionality. This equipment represents a significant risk to the rest of
the Internet, as without proper access controls, it facilitates enormous
DDoS attacks."

Following are the key 2009 DNS survey results from the survey—along with
positive, negative, or neutral "consequence" ratings—based on a sample that
included 5 percent of the IPv4 address space, nearly 80 million addresses.

   - *NEUTRAL: There are an estimated 16.3 million name servers on the
   Internet;* this represents a 40% increase in 2 years likely due to an
   explosion in the population of "non-traditional", proxy DNS servers embedded
   in broadband access devices or customer premises equipment (CPE).
   - *VERY DISTURBING: 79.6% of the name servers are open to recursion;* this
   represents a 27% increase in the last 2 years, likely related to the
   increase in proxy DNS servers in CPE. Unfortunately, all these name servers
   can be used maliciously to execute DDOS attacks, posing a significant threat
   to the Internet.
   - *POSITIVE: Percentage of Microsoft DNS Servers is now almost negligible
   at .37%; *this is likely due to greater awareness of the risks of
   exposing Windows computers to the Internet.
   - *POSITIVE: Percentage of zones with one or more name servers open to
   zone transfers decreased to 16% from 31%* (in 2008); administrators are
   paying closer attention to configuration of external DNS servers, realizing
   that they need to configure ACLs to prevent zone transfers, which can leave
   them open to DOS attacks.
   - *POSITIVE: The number of DNSSEC signed zones increased significantly—by
   approximately 300%; *this indicates that momentum in DNSSEC adoption is
   increasing. This could be the result of greater awareness and adoption due
   to the Kaminsky vulnerability last year and support for DNSSEC signed in
   parent zones (.org).

*Related Links:* Executive
Summary<http://www.infoblox.com/library/pdf/2009-DNS-survey-result.pdf>
, Press Release <http://www.infoblox.com/news/release.cfm?ID=149>

*Related topics:* DNS <http://www.circleid.com/topics/dns>,
DNSSEC<http://www.circleid.com/topics/dnssec>
, Security <http://www.circleid.com/topics/security>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.afrinic.net/pipermail/africann/attachments/20091117/b99a2e81/attachment.htm