Remembering Dan Kaminsky
Widely-respected security expert Dan Kaminsky passed away on April 23 from diabetic ketoacidosis at the age of 42. His considerable legacy went beyond expertise with a rare and memorable kindness.
Last Saturday, as Hacker News added a black banner to the top of their page, people who’d known Dan shared their own special memories.
“Dan was always generous with his time and expertise. He was the kind of person whom you could expect could easily become very rich, but was entirely unmotivated by money. Dan was fascinated to learn the inner workings of things we all take for granted — such as the Domain Name System. A true hacker,” remembered one Hacker News commenter.
And security entrepreneur Ryan Lackey remembered Kaminsky as “basically the best example of ‘infectious enthusiasm’ combined with being really smart and interested in a lot of stuff… He’s going to be missed by a lot of people around the world for a long time.”
Monkeying Around
Kaminsky learned to code by the age of five, after receiving a Radio Shack computer, his mother told the New York Times. And by the age of 11, there was an angry phone call from the network administrator for the western United States complaining someone was “monkeying around in territories where he shouldn’t be monkeying around” (specifically, military domains). His mother tells the Times that the caller threatened to cut off the family’s internet access.
She’d countered by promising a newspaper ad announcing “Your security is so crappy, even an 11-year-old can break it.”
Kaminsky’s stepfather had worked for McAfee as a data engineer consultant, and as a young man Kaminsky himself went on to work at Cisco designing security infrastructure for large-scale network monitoring systems — before he’d even graduated from college.
But it was attending the Black Hat security conference at the age of 20 that cemented his interest in information security, according to a 2007 interview by Dark Reading (which quips that instead of dropping out of school, Kaminsky dropped back into college to finish his degree in business computing from Santa Clara University).
By the age of 22, he was giving talks at Black Hat himself, as well as at other tech conferences around the world. Kaminsky told the site he was thrilled to be interacting “with the smartest people I’d ever met in my life.” In 2002 Kaminsky co-authored the book Hack Proofing Your Network. And for 18 years, starting in 2002, he’d contributed to the secure networking utilities OpenSSH (and was an active participant on its mailing list).
Kaminsky joined the Seattle-based cybersecurity firm IOActive, where he was director of penetration testing. For three years, Kaminsky offered Microsoft security advice for Windows Vista, Windows 7, and Server 2008 operating systems, according to his online biography. ZDNet reports Kaminsky also provided cybersecurity advice for several Fortune 500 companies.
In an effort to honor @dakami's character and legacy, we should all make a random act of Kaminsky weekly. Make it a point to be kind and helpful to someone, friend or stranger. Legit helpful and kind, take it over the finish line. Be the persistent guide he was. Then do it again.
— Dr. Russ (@dntlookbehindu) April 24, 2021
The Register remembers Kaminsky’s involvement in a major security story in 2005 when Mark Russinovich (now chief technology officer of Microsoft Azure), discovered Sony BMG decided was secretly installing rootkits on computers as an antipiracy device. It was Dan Kominsky who performed a DNS-based investigation of 9 million North American domain-name servers to irrefutably illustrate the gravity of the incursion — identifying at least 350,000 affected networks, including military and government networks — ultimately concluding Sony’s software “is most likely a hundreds-of-thousands to millions of victims issue.” That made the problem impossible to ignore.
And in 2006 the technology news site Hackaday was reporting on Kaminsky’s discovery that 1 in 3 SSL boxes shared a private key, meaning encrypted SSL traffic could be read with any identical box.
Kaminsky’s DNS Bug
But it was in 2008 — when Kaminsky was still in his 20’s — that he discovered a major threat to the internet itself: a vulnerability in the domain name system that would allow hijacking and impersonating of every domain.
In an animated video by Duo Security, Kaminsky remembered taking his findings to Paul Vixie, one of the early contributors to the DNS protocol, who was so stunned he’d first stressed to Dan that “I need you to never tell anyone about this on an unencrypted phone line again.”
The two persuaded Microsoft to convene a secret meeting of the world’s senior cybersecurity experts. In Kaminsky’s re-telling, Vixie described the meeting as “I’ve got a whole bunch of people. They’re going to get on a plane, they don’t know why.”
It worked. In 2016 the Black Hat conference was still hailing it as “the largest synchronized fix to the Internet’s infrastructure to date.” Infosecurity magazine remembers a flood of simultaneous patches from Microsoft, Cisco, Sun, and every major Linux distribution.
And in the years to come, it was often referred to as simply “Kaminsky’s DNS bug.” Two commenters on Hacker News even remembered being taught Kaminsky’s DNS cache poisoning attack as an exercise in college.
And soon after, and for over a decade, Kaminsky was also one of the “trusted representatives of the internet community” chosen to participate in root key-generating ceremonies that assures the integrity of the DNS system. (Kaminsky was one of just seven recovery-key holders.)
Dan Kaminsky is one of the DNSSEC root recovery key holders, but he's not Twitter verified. Maybe we shouldn't trust him. @dakami
— SwiftOnSecurity (@SwiftOnSecurity) November 24, 2014
Proud and Defiant
What’s striking about the remembrances is how many of them turn to Kaminsky’s personal kindness. New York Times cybersecurity reporter Nicole Perlroth remembered him as a mentor to both journalists and aspiring hackers. “In a community known for its biting, sometimes misogynistic discourse on Twitter, Mr. Kaminsky stood out for his empathy.” Kaminsky even developed a mobile app (named DanKam) to help the colorblind and helped develop telemedicine tools for the National Institutes of Health (which he later tried to implement during the pandemic). emembering his roots, Perlroth writes, “He would often foot a hotel or travel bill to Black Hat for those who could not afford it.”
No one that knew Dan Kaminsky well is talking about DNS today. They are talking about kindness, boundless energy and positivity, spontaneous adventures, and how hard he worked to lift others up. Want to emulate one of the greatest hackers of all time? Let that be your guide.
— Matt Devost (@MattDevost) April 24, 2021
Even David Ulevitch, an Andreessen Horowitz general partner and the founder and CEO of OpenDNS, remembered in a comment on Hacker News that Kaminsky “was the guy who let me crash in his room at Defcon when I was a minor and was too young to book my own room.
“This kicked off 20 years of friendship. He was brilliant, zany, ADD x 1000, and always endearing and loving… He was a hacker’s hacker, and the guy you want in your corner.”
Jeff Moss, the founder of the Black Hat and Defcon security conferences, has helped assemble a YouTube playlist collecting up Dan’s talks over the years.
When I got married in Singapore 11 years ago Dan was one of five friends who did a last minute YOLO and flew out to be one of my groomsmen. If you don’t know Chinese wedding traditions let’s just say there are shenanigans the bridesmaids make you endure. There is video evidence😂
— Jeff Moss (@thedarktangent) April 25, 2021
And the Times fondly remembers how Kaminsky making his points colorfully but forcefully. For example, in 2016 Kaminsky used a keynote at the Black Hat security conference to deliver some biting criticism of the cybersecurity industry, saying “Everybody looks busy, but the house still burns.”
And a 2013 article for Wired about Bitcoin also shows Kaminsky’s willingness to face the world with a cheery yet bracing skepticism. (“I’ll be blunt: Money’s gotten buggy… Bitcoin could basically be thought of as the Internet, applied to Money.”) Later Kaminsky added, “After all, the internet runs on a foundation of buggy technologies, and it survives. Why not Bitcoin?”
I’m increasingly thinking that every functioning system has two forms: The abstraction that outsiders are led to believe, and the reality that insiders actually and carefully operate.
You don’t incrementally learn a system. You eventually unlearn its necessary lies.
— Dan Kaminsky (@dakami) January 17, 2018
In his 2016 retelling of the DNS vulnerability, Kaminsky argues that “We made the internet less flammable. The internet was never designed to be secure. The internet was designed to move pictures of cats…
“Somehow… the global economy has moved into our world. And we’re just sitting here, like, ‘Man, we built this in 1983. We didn’t think you’d be moving trillions of dollars on this.'” The answer? “Some of us got to go out and fix it.”
And the site Dark Reading opened its testimonial with a typically inspiring quote from Dan himself, back in 2015.
“We’re hackers: we’re not afraid to get into how things work. Let’s use that knowledge and fearlessness and make things work better.”
Sunday 5/2 we’re having an online memorial for @dakami on the #defcon Discord server (https://t.co/i1AOpC8RP6). Come share your favorite stories and join us in celebrating the life of a hacker whose life elevated the whole community.
thx to @gadievron for this. pic.twitter.com/W9yde3ZScr
— DEF CON (@defcon) April 26, 2021
