"It's a very fundamental issue with how the entire addressing scheme of the internet works," Securosis analyst Rich Mogul said in a media conference call. "You'd have the internet, but it wouldn't be the internet you expect. [Hackers] would control everything."
The flaw would be a boon for "phishing" cons that involve leading people to imitation web pages of businesses such as banks or credit-card companies to trick them into disclosing account numbers, passwords and other information.
Attackers could use the vulnerability to route internet users wherever they wanted, no matter what website address is typed into a web browser.
Security researcher Dan Kaminsky of IOActive stumbled upon the domain name system (DNS) vulnerability about six months ago and reached out to industry giants including Microsoft, Sun and Cisco to collaborate on a solution.
DNS is used by every computer that links to the internet and works similar to a telephone system routing calls to proper numbers, in this case the online numerical addresses of websites.
Kaminsky built a web page, Doxpara.com
, where people can find out whether their computers have the DNS vulnerability.
full story from M&G here