Listing of DNS vulnerabilities

Question

I am currently studying how to setup DNS servers and all aspects of the DNS system. I would also like to study the security aspect. I want to use current DNS server attack on my test servers. Is there one place that lists the current attacks that are used by hackers so I can learn how to prevent them?

Answer 1

I'm not sure that there's any single place that lists all of the vulnerabilities related to DNS, but here are some pointers you might use for further research.

General DNS Weaknesses

One broad category of DNS vulnerabilities would be at the protocol- and system-layer.

• The wikipedia article on DNS lists security issues with the system.
• A particular vulnerability is cache poisoning.
• You can learn about DNSSEC as a countermeasure against some of the weaknesses in the protocol.
• Here's a list of notes on DNS that point out several system-level weaknesses.
• DNS is described in numerous RFCs. (That list is not up to date. You can find newer RFCs by looking at the references section in a recent DNS RFC.) Modern RFCs include a "Security Considerations" section that discusses security aspects related to the topic of the RFC.

Specific Vulnerabilities in DNS Implementations

Another broad category of vulnerabilities are bugs in specific implementations of DNS. There have been so many bugs in ISC Bind, for example, that this attack vector is much more likely to be successful than an attack at the system level (this depends on the target and the environment, though).

• Search the National Vulnerabilities Database. (E.g. ISC Bind)
• Search at SecurityFocus
• Look for exploits in the exploit database.
• Metasploit and various other scan tools may be able to automatically detect vulnerabilities on unpatched servers.

Complex Interactions

Studying DNS in a vacuum isn't really enough, though. DNS interacts with other protocols in interesting ways.

For example, if your network doesn't protect against rogue DHCP servers, it may be possible for an attacker to run a DHCP server that hands out a lease that points to a rogue DNS server. The DNS server then returns whatever addresses the attacker wants -- substituting his own address for paypal.com, or rerouting email, for example.

Answer 2

Your question is a bit vague.

If you want to learn about attacks on the DNS system, make sure you first fully understand how DNS works (and DNSSEC, if you're interested in the security of that as well). Then I recommend you read up on DNS cache poisoning attacks, as there are multiple kinds and DNS is plagued most by those.

Of course, DNS server software suites have been plagued by all kinds of bugs, but those are implementation bugs and not protocol bugs.