Could Domain Name Server Poisoning Be Affecting Your Bottom Line?

Are you a business owner with a busy website recording thousands, maybe even millions of hits a day?  Have you noticed lately that the numbers seem to be falling precipitously for no good reason?  Maybe you should look more closely at your domain name servers, the programs that route customers to your site; the following fictional scenario explains why.

Imagine you are a huge multi-national corporation with a very recognizable trademark and several million hits a day on your website.  Then, one month, your IT manager notices a sudden downturn in hit numbers.  He brings this fact up at your next management meeting.  The sales manager has something to say too: sale of your products on the Internet is way down, yet sales at your brick and mortar outlets have never been better.  What’s going on?  Around the table all eyes are suddenly on the Internet division.  That division’s manager throws up his hands; he says sales as a percentage of hits remains constant, it’s not the fault of his website. So where have all the potential customers gone?  Nobody seems to know.

A hand goes up at the end of the table farthest from the CEO’s chair.  One of the newest members of the management team, an assistant manager in the company mailroom, one of those individuals expected to be seen but not heard unless asked, has something to say.  Hesitantly she describes something strange that happened a few days ago on her home computer: she typed in the company domain name and was taken directly to an unfamiliar website.  She’d tried the address again and got your company the second time, but she’d been wondering about that other company ever since.

The sales manager rolls his eyes, “You put in the wrong address,” he says.  “No,” the underling answers with a bit more confidence, “I didn’t. The address history is still on my computer.”

Meanwhile, Paul the IT man is typing frantically on his laptop. “What’s going on, Paul?” asks the CEO.  Paul looks up: “I think I know what happening.  We’ve been poisoned!  I’d like everybody here with a computer to try typing in the company website address.”  The CEO shrugs and reaches for his laptop.  Of course everyone follows his lead.  “What’s the problem?” says the sales manager contemptuously after a bit, “I got our site!”  “Well I didn’t!” the CEO says.

What this fictional company discovered is called DNS poisoning. Every domain and therefore every website depends on computer programs called Domain Name Servers (DNS) to quickly and accurately route requests for individual websites. If those servers are hijacked by malicious hackers, they will bypass the legitimate website and take the potential customers to the hackers’ website where they can be sold a competitor’s product or fitted with a virus in hopes of ruining the original company’s reputation.  Just like in the scenario above, it might not happen every time somebody types in your domain name—the hacker doesn’t want to kill the golden goose—but it will happen enough to profit the hacker and cost you customers.

How common is this?  One security expert, the discoverer of a serious vulnerability in 2008, estimates that 1 to 3 percent of all domain name servers have been compromised.  Not an imposing number, certainly, but if you happen to be one of those 1 to 3 percenters…

What can be done?  There is a security protocol named “DNS Security Extension” (DNSSEC) available.  While there is movement toward covering the entire domain name system with this protocol, at the moment only a few domain name extensions are covered.  The U.S. government has mandated all dot-Gov and dot-Mil domains have DNSSEC protection.  Dot-Org is possibly the only generic top-level-domain extension under its umbrella (at least there has been talk of it doing so), and as for the country-code extensions, only Sweden, Bulgaria, Brazil, Puerto Rico and Turkmenistan have the coverage.