The man who found the flaw at the bottom of the internet — a break in DNS itself — and then, instead of selling it or dropping it, quietly herded every major vendor on earth into a single coordinated patch. It was the finest hour anyone in the field had. A year later, on the eve of Black Hat, an anonymous crew rooted his servers, read four years of his mail, and published his life to prove that the people who lecture the world about security cannot always defend their own boxes. He laughed it off in one line and went back to work. He died at 42, and the scene is still arguing about how to remember him.
Messy, but heh. Walk onto a battlefield, you might get shot.
Daniel Kaminsky — "Dan," b. Feb 7, 1979; security researcher, DEF CON / Black Hat fixture, chief scientist at White Ops FACT
THE SAVE
In 2008 discovered the fundamental DNS cache-poisoning flaw and ran the coordinated multi-vendor patch — the one time the whole industry moved as one, on his say-so FACT
THE DRAMA
On Black Hat eve 2009, the crew ZF0 rooted his boxes and dumped his passwords, résumé, mail and private life — alongside Kevin Mitnick and others (see Crew Rivalries)
THE RESPONSE
A one-line shrug — "walk onto a battlefield, you might get shot" — and back to work. The good sport of the massacre
STATUS
DECEASED — died April 2021, age 42, of diabetic ketoacidosis, per his family
This file is not an accusation; there is nothing to accuse Kaminsky of. It is a record of a rare thing — a researcher who found the keys to the kingdom and handed them back — and of what the scene did to him anyway. The DNS save is fact, at full strength. The 2009 owning is documented, in a published zine. The two sit side by side because that is the scene in one man: it will build a monument to your competence and dump your inbox in the same breath.
the drama timeline
ACT I — THE FLAW AT THE BOTTOM OF THE INTERNET (2008)
Kaminsky finds a break in DNS itself, realizes it threatens the whole internet, and does the hardest thing in security: he keeps his mouth shut and gets everyone patched first.
EARLY 2008
The discovery
Kaminsky identifies a fundamental weakness in the way DNS resolvers accept answers — a cache-poisoning technique that sidesteps the usual defenses by hammering non-existent "sibling" names until a forged reply guesses the right transaction ID. With only 65,536 possible IDs, "given enough opportunities" it was guessable. In plain terms: an attacker could quietly redirect the internet's address book. Banks, mail, updates — all of it.
Rather than publish, Kaminsky organized a secret summit at Microsoft and marshalled a synchronized, multi-vendor fix — Microsoft, Cisco, Sun, the BIND maintainers and more — released together on July 8, 2008. It was the single most successful coordinated-disclosure operation the field had ever run. The details leaked early (July 21), but by then the world was largely patched. This is Kaminsky at full strength, and no one disputes it.
A year after the save, an anonymous crew decided the industry's celebrities were all reputation and no opsec — and proved it on the most famous of them.
JUL 2009
ZF0 issue 5 — the whole life, dumped
On the eve of the Black Hat Briefings, the crew ZF0 ("Zero for 0wned") announced it had rooted the servers of the industry's marquee names and published a roster — Kaminsky among them — with roughly 75,000 passwords in total. For Kaminsky specifically they dumped passwords ("Five character root password? Niiiiiiice."), his résumé, his mailing-list traffic, his toolkit, and his private correspondence. They wrote that they were "mostly sparing the girlfriend," then published his partner's private messages anyway. Those messages are not reproduced here — that ZF0 aired his private life is the point; a private person's words are not the drama. The technical claim, however, landed: one of the most decorated names in security was sitting on a box a motivated stranger walked straight into.
Kaminsky was not the only scalp. The same dump popped Kevin Mitnick, the world's most famous security consultant, on his own hosting box, plus Julien Tinnes and a wall of scene forums. Contemporaneous coverage called it, accurately, "Security Gurus 0wned by Black Hats." The point of the exercise was precisely that the biggest names were not exempt.
To understand why the owning was news, you have to understand what Kaminsky was to the scene: a headliner. His talks were events. Here he is at DEF CON 13 with "Black Ops of TCP/IP" — the kind of set the community still trades, three years before the DNS save made him globally famous. This is the man ZF0 chose to own: not a nobody, the marquee.
Kaminsky at DEF CON 13 (2005), "Black Ops of TCP/IP." The showman at full tilt — the reason a roomful of the world's best turned out for him, and the reason owning him made a zine's cover.
Kaminsky's public response became almost as famous as the hack: "Messy, but heh. Walk onto a battlefield, you might get shot." No lawyers, no takedown campaign, no wounded blog post — just an occupational-hazard shrug and a return to work. Whatever the crew intended, it did not land the humiliation on him the way it did on some of the others. He treated getting owned as the cost of standing on the field.
He spent the next decade as one of the field's most trusted elders. Then he was gone, and the internet had to be told, twice, what did and did not kill him.
2010s
Elder statesman
Kaminsky became one of the seven Trusted Community Representatives entrusted with a key to the DNSSEC root — a literal key to a piece of the internet — and later chief scientist at the security firm White Ops (now HUMAN). He stayed a fixture on stage and a mentor to a generation, the rare celebrity researcher the scene mostly agreed to respect.
Kaminsky died at his home in San Francisco in April 2021, age 42. His family stated the cause was diabetic ketoacidosis — his niece Sarah writing that the death had "everything to do with diabetic ketoacidosis" and "nothing to do with COVID-19 vaccination," and his aunt, Dr. Toby Maurer, giving the same cause. He had struggled with diabetes for years and been hospitalized for it. The cause is stated here exactly as his family stated it; anything else about that day is noise the family already had to answer once.
The tributes were immense, and earned. Alongside them the scene carried a rougher memory — the famously boozy stage sets, the running joke about how much he'd had. That is reputation, the community's own barroom lore about one of its stars, and it is worth naming honestly because the scene traded on it for years and then had to sit with it. It is not the cause of his death, which his family stated plainly, and this file does not pretend otherwise. The archive keeps both the monument and the memory, and refuses to collapse one into the other.
ZF0's case: the crew's whole thesis was that the security industry is a status game and its celebrities coast on reputation while their own machines rot. On the technical merits they were right about Kaminsky's box — a five-character root password on an internet-facing host is exactly the negligence they said the scene's elite hid behind media profiles. They proved it by reading his mail.
The owning happened: this is not disputed. The zine is published, mirrored for over a decade, and Kaminsky himself acknowledged the breach. The receipts are real.
The save outweighs the box: whatever ZF0 found on one server, Kaminsky's actual record is the 2008 DNS save — the discovery and the coordinated patch that protected the entire internet. That is the fact that survives, and it is not in dispute [1].
Owning a box is not owning a man: publishing a private partner's messages to score a point against a public researcher was cruelty aimed at a non-public person, and it proved nothing about DNS or opsec. The restraint they bragged about ("mostly sparing the girlfriend") they didn't actually keep — and this file keeps the restraint they didn't [3].
He took it like a professional: the "battlefield" shrug is the tell. A man genuinely humiliated lawyers up; Kaminsky treated the owning as the weather and went back to securing the internet [4].
YOU DECIDE
ZF0 was right about the box and wrong about the man. A five-character root password on a public host is real negligence, and the crew earned the technical point. But the negligence on one server does not touch the 2008 save, which stands as the best week of coordinated defense the field has ever had; and dumping a private partner's fear to embarrass a public researcher was cruelty, not proof. The shrug he answered with — walk onto a battlefield, you might get shot — is the most Kaminsky thing on this page.
The archive does not deify, and it does not gloat. It keeps the DNS patch, the ZF0 zine, and the cause of death his family stated — and it leaves the private messages where they lie.
evidence locker
PRIMARY / REFERENCE
Wikipedia — Dan KaminskyATTRIBUTED — dated record: birth (Feb 7, 1979), the 2008 DNS cache-poisoning discovery and the July 8, 2008 coordinated multi-vendor patch, the DNSSEC root key role, the 2009 ZF0 publication, and death (April 2021, age 42, diabetic ketoacidosis).
en.wikipedia.org/wiki/Dan_Kaminsky
ZF0 issue 5 (Exploit-DB)SELF-PUBLISHED — the crew's own zine dumping Kaminsky's boxes; mirrored publicly for over a decade and archived locally under research/zines/zf0-5.txt. The source for the owning; the private partner material it contains is deliberately not reproduced on this page.
exploit-db.com/papers/12892
The Register — "Security elite pwned on Black Hat eve"ATTRIBUTED — 29 July 2009; source of Kaminsky's verbatim "walk onto a battlefield, you might get shot" response.
theregister.com/2009/07/29/kaminsky_hacked
troll.fan — The ChronicleCROSS-LINK — the whole scene arc as one timeline.
troll.fan/timeline.html
The standard. Dan Kaminsky was a public figure and is deceased; you cannot defame the dead, and the care taken here is a matter of accuracy and taste. The DNS discovery and the 2008 coordinated patch are stated as fact, at full strength. The 2009 ZF0 owning is documented in a published zine, mirrored for over a decade and archived locally under research/zines/; the private partner material it contains is deliberately withheld — that ZF0 aired his private life is the record, a private person's distress is not. His "battlefield" response is quoted verbatim from contemporaneous press. His cause of death is stated exactly as his family stated it — diabetic ketoacidosis — and the scene's memory of his drinking is given as reputation, never as cause. If a line here couldn't survive scrutiny, it wouldn't be on the page.