Dan Kaminsky
More info
- Born
- 1979, San Francisco
- Died
- 2021
- Known for
- The 2008 DNS vulnerability
The researcher who in 2008 found a DNS flaw that let anyone poison a resolver's cache in seconds — and got the whole industry to patch on the same day.
Classic cache poisoning against DNS needed luck: one shot per name per TTL. Kaminsky realised you could query random, nonexistent subdomains and slip a forged authority record for the whole domain into every reply. With only a 16-bit transaction ID, a resolver fell in seconds. He kept quiet and instead coordinated a patch from essentially every DNS vendor, released on 8 July 2008. The fix was to randomise the source port too — a plaster, not a cure, which gave DNSSEC fresh momentum.
Earlier, in 2005, he had used DNS caches to estimate how far Sony's copy-protection rootkit had spread. He died in 2021 at 42, remembered as much for his generosity as for his findings.