[Ed Hansberry]

http://www.dnsstuff.org

I am sure most of you by now are at least aware of the DNS Poisoning vulnerability that affects all DNS servers around the world, and where many vendors, including Microsoft, Cisco and Redhat, released patches to their products on the same day in July before exploit code could be written. If you aren't aware of it, Wikipedia has a pretty good overview.

As of right now, over half of the worlds DNS servers have not been patched, even though their vendor has likely released an update, unless they run Mac OS-X Server.

One of the main reasons someone would use this exploit is to make you think you are on a secure and familiar site, like your banks website. If you typed www.mybank.com in your browser, your DNS server could actually be tricked into redirecting you to some server in Russia that looked exactly like your banks site, and your browser would still show www.mybank.com in the URL at the top. Because many of us access this information on our devices, we should be able to trust the DNS server our phone is using, which is usually provided by our cellular provider. I finally found a test that works on Windows Mobile devices. Head over to DNSStuff.com and run the "DNS Vulnerability Check" in the lower left. In order to get the button to be visible and work, you may have to put Pocket IE into "desktop" mode. I am pleased to say that T-Mobile USA got all Good and Great marks on each of the tests, at least on their DNS servers in Washington state.

If your provider fails the tests, you should contact them. You can also override the DNS entries in your internet connection settings to use the free DNS servers at OpenDNS.org.

[Ed Hansberry]

http://www.dnsstuff.org

I am sure most of you by now are at least aware of the DNS Poisoning vulnerability that affects all DNS servers around the world, and where many vendors, including Microsoft, Cisco and Redhat, released patches to their products on the same day in July before exploit code could be written. If you aren't aware of it, Wikipedia has a pretty good overview.

As of right now, over half of the worlds DNS servers have not been patched, even though their vendor has likely released an update, unless they run Mac OS-X Server.

One of the main reasons someone would use this exploit is to make you think you are on a secure and familiar site, like your banks website. If you typed www.mybank.com in your browser, your DNS server could actually be tricked into redirecting you to some server in Russia that looked exactly like your banks site, and your browser would still show www.mybank.com in the URL at the top. Because many of us access this information on our devices, we should be able to trust the DNS server our phone is using, which is usually provided by our cellular provider. I finally found a test that works on Windows Mobile devices. Head over to DNSStuff.com and run the "DNS Vulnerability Check" in the lower left. In order to get the button to be visible and work, you may have to put Pocket IE into "desktop" mode. I am pleased to say that T-Mobile USA got all Good and Great marks on each of the tests, at least on their DNS servers in Washington state.

If your provider fails the tests, you should contact them. You can also override the DNS entries in your internet connection settings to use the free DNS servers at OpenDNS.org.

[blazingwolf]

Thanks for the heads up on this Ed. I checked Verizon Wireless in Virginia and they report Good for just about everything. The only exception being a great for Source port standard deviation.

My Verizon DSL is another matter. It shows poor for all source port tests. Maybe a cal to customer service is in order for this.

[rlobrecht]

Thanks Ed. I just checked AT&T wireless (3G) in Houston, and everything is labeled as GOOD.

[Ed Hansberry]

Originally Posted by blazingwolf

My Verizon DSL is another matter. It shows poor for all source port tests. Maybe a cal to customer service is in order for this.

I'd be switching my home router to OpenDNS.org in about 2 seconds on that deal. I switched to OpenDNS.org a few months ago because I could block sites (adware, porn, etc) from ever entering my home LAN. The side benefit is I don't care if my cable provider is on top of things on patching their DNS servers. OpenDNS.org was one that worked closely with the industry to get this patched fast.

[blazingwolf]

Originally Posted by Ed Hansberry

I'd be switching my home router to OpenDNS.org in about 2 seconds on that deal. I switched to OpenDNS.org a few months ago because I could block sites (adware, porn, etc) from ever entering my home LAN. The side benefit is I don't care if my cable provider is on top of things on patching their DNS servers. OpenDNS.org was one that worked closely with the industry to get this patched fast.

Done.

Thanks again for this. Very timely info that is coming in very useful for me.

[Phillip Dyson]

Originally Posted by Ed Hansberry

I'd be switching my home router to OpenDNS.org in about 2 seconds on that deal.

I would like to do this. I've actually already created an account. I have a Linksys G router and noticed a DNS service that can be enabled. Is this where I would configure it to use OpenDNS.org?

Also, would I install the dynamic update client to one of my PCs or is there some way to set that up in the router?

thanks

[Ed Hansberry]

Originally Posted by Phillip Dyson

I would like to do this. I've actually already created an account. I have a Linksys G router and noticed a DNS service that can be enabled. Is this where I would configure it to use OpenDNS.org?

Also, would I install the dynamic update client to one of my PCs or is there some way to set that up in the router?

thanks

I have a Lynksys G as well. On the initial page where you can type in the DNS servers, type in the OpenDNS.org dns server addresses. If you only wnat to use their DNS services, your done. If you want to use their filtering services, like blocking porn or adware sites, you'll need to do a few more steps.

On the DDNS page, you'll need to get a Dynamic DNS number. I use DynDNS.org - which you'll need an account for. This is so OpenDNS can find your IP address. I then use a program called OpenDNS Updater at http://blog.opendns.com/2007/09/07/m...ic-ip-updater/ that can communicate with OPenDNS.org periodically.

It took me about 20 minutes to sign up for everything and get it all working, but now that I have, it is trouble free, and free of cost as well.