The cybersecurity researcher community has been in mourning this past week as legendary hacker Dan Kaminsky tragically passed away on April 23.
Kaminsky was a well known and widely loved figure, for his character, his skills and his research. He was a fixture in the security conference scene, in particular at the annual Black Hat and DEFCON security conferences where he was legendary for numerous discoveries and research. Kaminsky will forever be remembered for the flaw in DNS that he discovered in 2008 and was able to rally the entire technology industry together to literally save the internet as we know it.
A graduate of Santa Clara University, Kaminsky worked at a number of companies including Cisco and Avaya, before moving on to IOActive and then went on to co-found WhiteOps in 2012, which has recently rebranded as HUMAN. Kaminsky suffered from diabetes throughout his life and was only 42 years old when he succumbed to diabetic ketoacidosis at his home in San Francisco.
Early Work
In 2001, Kaminsky was actively contributing to the widely used open source OpenSSH project. He is credited with writing critical VPN-type functionality known as the Dynamic Forwarding patch into the project.
On the conference scene, Kaminsky was a regular speaker at Black Hat and DEF CON with what became a regular slot that was referred to as Black Ops. His talks looked at core foundational elements of technology, including TCP/IP and DNS.
DNS
It was with DNS that is perhaps his greatest research legacy, for a discovery and more importantly response, to what might have been one of the most impactful security flaws of all time. In July 2008, scores of major technology vendors including Microsoft, Cisco, Juniper and Sun, and every Linux distribution simultaneously announced patches for a critical flaw in DNS - a flaw that Kaminsky had discovered.
"I found that there is an issue with DNS, a fundamental issue based on design," Kaminsky said on a multivendor conference call announcing the vulnerability at the time.
A month later, in a scene that had not ever been seen before at Black Hat and never since, thousands gathered to hear Kaminsky explain in clear detail what the issue was, how it was discovered and how working together enabled a fix.
The patches that came out in 2008 were only a stop gap solution for DNS, with the longer-term best practice being the implementation of DNSsec. In the years following the 2008 disclosure, Kaminsky championed the adoption of DNSsec and encouraged anyone that would listen to learn about and adopt the technology. Kaminsky served as a member of the ICANN Trusted Community Representative group, one of the most elite groups on the planet, as a recovery key holder for DNSsec for the root zone of the internet.
In a tweet, Katie Moussouris, founder of Luta Security, who was working at Microsoft back in 2008, recounted that it was Kaminsky and his efforts to get vendors to work together to solve the DNS flaw that helped to inspire the creation of Microsoft Vulnerability Research.
"We owe him so much, we all do, People who will never know his name owe Dan," she wrote.
Always Learning, Always Teaching - a True Hacker
Among those that worked with and knew Kaminsky was Trey Ford, who is currently the VP, Platform Strategy & Trust at Salesforce. Ford was the general manager of Black Hat from 2012 to 2014 and continues to serve as a member of the Black Hat Review Board.
"Looking back, what stands out the most to me is the example of a humble beginner's mind that Dan brought to everything and everyone," Ford told Infosecurity. "He had this excitement about unlocking, learning, and sharing new information about literally anything - whether the learning was his own, or yours - and he met anyone right where they were. Patient. No judgement."
"His passion for sharing and learning was infectious and exemplary."
Jeremiah Grossman, CEO of BitDiscovery and member of the Black Hat Review Board, knew Kaminsky for over two decades, meeting him at Black Hat when the two were getting started in infosec.
"The goal for him was security… and it was never who was right or wrong, no big ego problem, just what the best answer was," Grossman told Infosecurity.
Grossman recounted that he and Kaminsky would call and email each other out of the blue several times per year to test flight some ideas. No one is an expert on everything, or even most things, so they both valued each other’s expertise to shoot ideas down, make them stronger, or to move on to another one.
"If you ever needed something, a favor, Dan would never say no… or that he didn’t have time. He’d make time," Grossman said. "Dan was a hacker in the truest expression of the word - a person that didn’t need a job title to define or honor him, he’d define it through action and contribution."