Join us at TNW Conference 2022 for insights into the future of tech →

The heart of tech

This article was published on August 3, 2015

    A huge DNS exploit could take down chunks of the internet

    A huge DNS exploit could take down chunks of the internet
    Owen Williams
    Story by

    Owen Williams

    Former TNW employee

    Owen was a reporter for TNW based in Amsterdam, now a full-time freelance writer and consultant helping technology companies make their word Owen was a reporter for TNW based in Amsterdam, now a full-time freelance writer and consultant helping technology companies make their words friendlier. In his spare time he codes, writes newsletters and cycles around the city.

    Last week the Internet Systems Consortium released a patch for a serious vulnerability in BIND, one of the most popular Domain Name Servers that’s bundled with Linux.

    The incident number CVE-2015-5477 details an exploit that allows a remote, unauthenticated attacker to crash DNS servers using BIND by sending a specially crafted command. There’s no specific way to protect against the attack, other than installing the patch immediately.

    The attack is reportedly so trivial that a single hacker could take down large chunks of the internet in a single move. All they would need to do is simultaneously crash enough DNS servers to cause a noticeable outage and serious implications for the internet.

    Ars Technica reports today that attacks have already begun as the code is available publicly. The attack is now actively being used against public DNS servers to cause them to crash.

    If you’re running a BIND DNS server, it’s important to patch as soon as possible to ensure attackers can’t take down your service.

    CVE-2015-5477 [ISC]

    Image credit: Shutterstock