Dan Kaminsky, a Web expert, with a list of vulnerabl servers.

By JOHN MARKOFF

SinceSince a secret emergency meeting of computer security experts at Microsoft’s headquarters in March, Dan Kaminsky has been urging companies around the world to fix a potentially dangerous flaw in the basic plumbing of the Internet.
While Internet service providers are racing to fix the problem, which makes it possible for criminals to divert users to fake Web sites where personal and financial information can be stolen, Mr. Kaminsky worries that they have not moved quickly enough.
By his estimate, roughly 41 percent of the Internet is still vulnerable. The problem is a global one, and the length of time required to fix it could leave many Web users vulnerable for weeks or months. And there are millions of places around the world where people might find themselves vulnerable to potential attacks, whether in their workplaces or in an airport lounge or Internet cafe.
Mr. Kaminsky, a technical consultant who first discovered the problem, has been increasing the pressure on companies and organizations to make the software changes before criminal hackers take advantage of the flaw.
He planned to publicly lay out the details of the flaw at a security conference in Las Vegas. That should force computer network administrators to fix millions of affected systems. But his explanation of the flaw will also make it easier for criminals to exploit it, and steal passwords and other personal information.
Mr. Kaminsky walks a fine line between protecting millions of computer users and eroding consumer confidence in Internet banking and shopping. But he is among those experts who think that full disclosure of security threats can push network administrators to take action. “We need to have disaster planning, and we need to worry,” he said.
The flaw is in the Domain Name System, a kind of automated phone book that converts humanfriendly addresses like google.com into machine-friendly numeric counterparts. The flaw could allow a criminal to redirect Web traffic secretly, so that a person typing a bank’s actual Web address would be sent instead to an impostor site set up to steal the user’s name and password. The user might have no clue about the misdirection. Unconfirmed reports in the Web community indicate that attempted attacks are already under way.
Some computer systems are immune to the flaw. About 15 percent of domain name servers in the United States and 40 percent in Europe, including those at major Internet providers like America Online and Deutsche Telekom, use software from a Dutch company called PowerDNS, which is not vulnerable.
Still, much of the Internet remains vulnerable. “I’m watching people patch, and I realize this is not an easy thing to do,” Mr. Kaminsky said .