OMEN
05-16-2008, 12:27 PM
'Our techs are working on it,' says an agency spokeswoman
A server problem at the U.S. National Security Agency (NSA) has knocked the secretive intelligence agency off the Internet.
The nsa.gov Web site was unresponsive at 10 a.m. EDT Thursday and continued to be unavailable throughout the day for Internet users.
The Web site was unreachable because of a problem with the NSA's DNS servers, said Danny McPherson, chief research officer at Arbor Networks Inc. DNS servers are used to translate things like the Web addresses typed into machine-readable IP addresses that computers use to find each other on the Internet.
The agency's two authoritative DNS servers were unreachable this morning, McPherson said.
Because this DNS information is sometimes cached by Internet service providers, the NSA would still be temporarily reachable by some users, but unless the problem is fixed, NSA servers will be knocked completely offline. That means that e-mail sent to the agency will not be delivered, and in some cases, e-mail being sent by the NSA would not get through.
"We are aware of the situation and our techs are working on it," an NSA spokeswoman said at 12:45 p.m. EDT. She declined to identify herself.
A similar DNS problem knocked Youtube.com offline in early May.
There are three possible reasons the DNS server was knocked offline, McPherson said. "It's either an internal routing problem of some sort on their side or they've messed up some firewall or [access control list] policy," he said. "Or they've taken their servers offline because something happened."
That "something else" could be a technical glitch or a hacking incident, McPherson said.
In fact, the NSA has made some basic security mistakes with its DNS servers, according to McPherson. The NSA should have hosted its two authoritative DNS servers on different machines, so that if a technical glitch knocked one of the servers offline, the other would still be reachable. Compounding the problem is the fact that the DNS servers are hosted on a machine that is also being used as a Web server for the NSA's National Computer Security Center.
"Say there was some Apache or Windows vulnerability and hackers controlled that server, they would now own the DNS server for nsa.gov," he said. "That really surprised me. I wouldn't think that these guys would do something like that."
The NSA is responsible for analysis of foreign communications, but it is also charged with helping protect the U.S. government against cyberattacks, so the outage is an embarrassment for the agency.
"I am certain that someone's going to send an e-mail at some point that's not going to get through," McPherson said. "If it's related to national security and it's not getting through, then as a U.S. citizen, that concerns me."
IDG
A server problem at the U.S. National Security Agency (NSA) has knocked the secretive intelligence agency off the Internet.
The nsa.gov Web site was unresponsive at 10 a.m. EDT Thursday and continued to be unavailable throughout the day for Internet users.
The Web site was unreachable because of a problem with the NSA's DNS servers, said Danny McPherson, chief research officer at Arbor Networks Inc. DNS servers are used to translate things like the Web addresses typed into machine-readable IP addresses that computers use to find each other on the Internet.
The agency's two authoritative DNS servers were unreachable this morning, McPherson said.
Because this DNS information is sometimes cached by Internet service providers, the NSA would still be temporarily reachable by some users, but unless the problem is fixed, NSA servers will be knocked completely offline. That means that e-mail sent to the agency will not be delivered, and in some cases, e-mail being sent by the NSA would not get through.
"We are aware of the situation and our techs are working on it," an NSA spokeswoman said at 12:45 p.m. EDT. She declined to identify herself.
A similar DNS problem knocked Youtube.com offline in early May.
There are three possible reasons the DNS server was knocked offline, McPherson said. "It's either an internal routing problem of some sort on their side or they've messed up some firewall or [access control list] policy," he said. "Or they've taken their servers offline because something happened."
That "something else" could be a technical glitch or a hacking incident, McPherson said.
In fact, the NSA has made some basic security mistakes with its DNS servers, according to McPherson. The NSA should have hosted its two authoritative DNS servers on different machines, so that if a technical glitch knocked one of the servers offline, the other would still be reachable. Compounding the problem is the fact that the DNS servers are hosted on a machine that is also being used as a Web server for the NSA's National Computer Security Center.
"Say there was some Apache or Windows vulnerability and hackers controlled that server, they would now own the DNS server for nsa.gov," he said. "That really surprised me. I wouldn't think that these guys would do something like that."
The NSA is responsible for analysis of foreign communications, but it is also charged with helping protect the U.S. government against cyberattacks, so the outage is an embarrassment for the agency.
"I am certain that someone's going to send an e-mail at some point that's not going to get through," McPherson said. "If it's related to national security and it's not getting through, then as a U.S. citizen, that concerns me."
IDG