[Infowarrior] - DNS Trouble Knocks NSA off Internet

[Richard Forno]

DNS Trouble Knocks NSA off Internet

Robert McMillan, IDG News Service

Thursday, May 15, 2008 10:40 AM PDT

http://www.pcworld.com/businesscenter/article/145945/dns_trouble_knocks_

A server problem at the U.S. National Security Agency has knocked the  
secretive intelligence agency off the Internet.

The nsa.gov Web site was unresponsive at 7 a.m. Pacific time Thursday  
and continued to be unavailable throughout the morning for Internet  
users.

The problem was resolved at around 11 a.m. Pacific time, according to  
Web site measurement company Netcraft.

The Web site was unreachable because of a problem with the NSA's DNS  
(Domain Name System) servers, said Danny McPherson, chief research  
officer with Arbor Networks. DNS servers are used to translate things  
like the Web addresses typed into machine-readable Internet Protocol  
addresses that computers use to find each other on the Internet.

The agency's two authoritative DNS servers were unreachable Thursday  
morning, McPherson said.

Because this DNS information is sometimes cached by Internet service  
providers, the NSA would still be temporarily reachable by some users,  
but unless the problem is fixed, NSA servers will be knocked  
completely off-line. That means that e-mail sent to the agency will  
not be delivered, and in some cases, e-mail being sent by the NSA  
would not get through.

"We are aware of the situation and our techs are working on it," a NSA  
spokeswoman said at 9:45 a.m. PT. She declined to identify herself.

A similar DNS problem knocked Youtube.com off-line in early May.

There are three possible reasons the DNS server was knocked off-line,  
McPherson said. "It's either an internal routing problem of some sort  
on their side or they've messed up some firewall or ACL [access  
control list] policy," he said. "Or they've taken their servers off- 
line because something happened."

That "something else" could be a technical glitch or a hacking  
incident, McPherson said.

In fact, the NSA has made some basic security mistakes with its DNS  
servers, according to McPherson. The NSA should have hosted its two  
authoritative DNS servers on different machines, so that if a  
technical glitch knocked one of the servers off-line, the other would  
still be reachable. Compounding problems is the fact that the DNS  
servers are hosted on a machine that is also being used as a Web  
server for the NSA's National Computer Security Center.

"Say there was some Apache or Windows vulnerability and hackers  
controlled that server, they would now own the DNS server for  
nsa.gov," he said. "That really surprised me. I wouldn't think that  
these guys would do something like that."

The NSA is responsible for analysis of foreign communications, but it  
is also charged with helping protect the U.S. government against cyber  
attacks, so the outage is an embarrassment for the agency.

"I am certain that someone's going to send an e-mail at some point  
that's not going to get through," McPherson said. "If it's related to  
national security and it's not getting through, then as a U.S.  
citizen, that concerns me."

(Anders Lotsson with Computer Sweden contributed to this report.)