Much news is being made of the DNS flaw identified by Dan Kaminsky. McAfee Avert Labs Blog has the most succinct description of the problem.

The vulnerability essentially comes from DNS servers using UDP and predictable port sequences during recursive queries. An attacker can guess the next port and respond to the query with a false address. The DNS server accepts the forged attack, and www.mybank.com becomes the attacker's IP address in its cache. It will respond to client requests for www.mybank.com with the forged information.

This can be quite a concern as the website, if properly duplicated, will look exactly the same to the end-user. What happens next is largely up what the attacker intends to do. The most common follow-up would be a phishing attack, wherein the website simply gathers people's banking credentials. Bruce Schneier wrote a recent Wired article on this flaw. Schneier makes an excellent point. "Stop assuming that systems are secure unless demonstrated insecure; start assuming that systems are insecure unless designed securely."

Related Links:

“The-Cat-is-Out-of-The-Bag” DNS Bug
http://www.avertlabs.com/research/blog/index.php/2008/07/23/the-cat-is-out-of-the-bag-dns-bug/

Dan Kaminsky: DNS Checker
http://www.doxpara.com/?page_id=1159

Lesson From the DNS Bug: Patching Isn't Enough by Bruce Schneier
http://www.wired.com/politics/security/commentary/securitymatters/2008/07/securitymatters_0723

Executives run businesses based on risk versus reward, right? To get action, we need to convey the dollars at stake and the likelihood there will be a loss. You’ll often see this as Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO).

The difficulty I run into is that there is not much hard data on the likelihood of an attack and the typical cost. We can guess, but then the figure ends up being skewed and the rationale does not stand up to scrutiny by senior management. I am hopeful that the recent disclosure laws change this by providing solid statistical information.

Hackers are not some ominous bad guys. For many years, I have been trying to explain this to family and friends, my staff, my colleagues and auditors. I use words like "criminal" or "attacker" in my memos and emails. Hackers have long been given a bad rap.

That rap is implicit in the question: would you hire an ethical hacker? Bank robbing and espionage may be crimes, but hacking? Linking the work ethical to hacking gives us an opportunity to highlight the difference between a talented unconventional IT wiz and someone practicing digital breaking-and-entering.