Blessed BailiWicked, Who Poisoned the Roots of DNS

Patron of DNS resolvers, trusted caches, and protocols everyone had assumed were safe.

Life

In 2008 Dan Kaminsky revealed a devastating attack against DNS. By quickly guessing the query identifiers and abusing "in-bailiwick" referrals, an attacker could poison a resolver's cache and redirect whole domains to hostile servers, before the legitimate answer arrived. The flaw was in the protocol itself, and the fix, source-port randomisation, took a coordinated effort across the whole Internet.

Prayer

O Blessed BailiWicked, who rewrites the map of names, teach our resolvers to distrust answers that come too readily. Amen.

How to celebrate

Celebrated by enabling source-port randomisation, adopting DNSSEC where possible, and remembering the summer half the world patched together.

A poisoned cache, a wrong road.