The Domain Name System (DNS) translates Internet domain and host names to IP addresses.
6
votes
3answers
114 views
Security implications of an exploited router
So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
4
votes
5answers
128 views
Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative ...
-6
votes
1answer
61 views
may DNS companies track visitors by traffic analysis? [closed]
Internet is based on name servers, we always type stackexchange.com in address bar to access this website no stackexchange's IP address. as ICANN is managing every DNS records for every website where ...
2
votes
1answer
101 views
External network DNS spoofing
I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios:
1. ...
-1
votes
1answer
62 views
Redirect attack [closed]
I just discovered that our server other's website for example: http://destiny.mbtosi.com/styles/new/images/no.png should say "This Web Page no longer exists." but in 50% hits it shows an image from ...
0
votes
1answer
65 views
The importance of changing DNS when Using Antifiltering software
Is it safe that sometimes my Anti-filtering program does not change the DNS address?
1
vote
1answer
92 views
Following redirects from HTTPS to HTTP - Secure?
So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting)
This means, in theory, if you ...
15
votes
3answers
938 views
DNS Amplification DDOS attack
During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
14
votes
7answers
952 views
Would it be possible to overload a large part of the internet, and if so then how?
Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
2
votes
2answers
345 views
DNS Spoofing vs DNS Cache Poisoning
What is the difference between DNS Spoofing and DNS Cache Poisoning ???
It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the ...
0
votes
3answers
443 views
To DMZ, or not to DMZ
So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network.
The 'networks' are:
Internal network
DMZ
The internet
And the servers we ...
5
votes
3answers
169 views
Why would you want to run DNS servers externally?
Something that's never made much sense to me is when environments have DNS servers which are publicly accessible (on the internet). This more often than not seems to leave them vulnerable to Cache ...
0
votes
1answer
144 views
DNS Cache Poisoning and Snooping
I'm trying to do two things here.
The first is poison the cache of a target DNS server. A scan has suggested the network I'm attacking is vulnerable to CVE-1999-0024.
My understanding of this ...
3
votes
1answer
89 views
Why is a separate reconnaissance server needed for DNS cache poisoning?
I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS).
What I understand from the ...
5
votes
2answers
316 views
Is this a DNS attack?
The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
2
votes
1answer
96 views
How to verify DNSKEY by using its corresponding DS
A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
The ...
4
votes
1answer
164 views
Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?
First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
0
votes
2answers
560 views
Anyone out there using Umbrella from OpenDNS? What exactly is it?
I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to ...
1
vote
1answer
287 views
What is a DNS leak?
I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
2
votes
2answers
221 views
DNS cache poisoning
What are the things the attacker needs to know from the victim to perform DNS cache poisoning ?
for example : IP , Port number and Transaction number
what else ?
8
votes
2answers
202 views
Do any DNS registrars support multi factor authentication?
I am looking for a DNS registrar that supports strong multi-factor authentication.
Does any DNS registrar support multi-factor?
Is this a legitimate need?
20
votes
3answers
716 views
What are some risks of purchasing a “used” domain name
If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there ...
-2
votes
1answer
101 views
how to protect against this vulnerability CVE-2012-5166 in the DNS [closed]
I need to know how to protect my DNS server of the vulnerability with iptables rules. Please can support me
5
votes
2answers
2k views
How can I identify open DNS resolvers in my network?
This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
4
votes
1answer
318 views
Which security risks are associated with alternative DNS providers?
I'm considering using an alternative DNS provider on my computer. Which risks do I run if I use one?
I already know that the DNS provider may return a malicious IP address when I'm trying to access ...
1
vote
2answers
125 views
anti virus acting up/DNS poisoning
I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks ...
4
votes
2answers
478 views
How do I find all domains hosted on a single host?
I found several websites offer a function that allows you to list all domains hosted on the same machine, e.g you supply a.com, and it tells you b.com and c.com are both hosted on the same machine as ...
0
votes
1answer
176 views
DNS Vulnerabilities Scanner [closed]
I'm looking for a DNS Vulnerabilities Scanner tools, which is specially for DNS vulnerabilities, that shows me the Vulnerabilities, and the solution for that, like "Nessus" and "Acunetix" but just ...
5
votes
3answers
269 views
Does NAT break source port randomization?
The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.
Does NAT break the security benefits of source port randomization?
In more detail, consider ...
0
votes
0answers
116 views
How to locate DNS information at localhost windows machine [closed]
Windows has some host information at hosts file, and I am wondering whether this file is picked up by DNS server if DNS server is set.
Or where is DNS information located at?
0
votes
1answer
193 views
How have DNS recursion attacks happened?
There are a few resources describing how to carry out DNS recursion attacks. Is there any good explanation to help me understand how these attacks work and if systems on my network are still ...
2
votes
0answers
374 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
2
votes
1answer
94 views
How did DNSChanger rogue name servers work?
I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites ...
15
votes
4answers
593 views
Global Blackout is a myth?
In order to shut the Internet down, anonymous claimed that putting-down the
13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
3
votes
2answers
129 views
Unecrypted connection to server - safe?
I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL.
Now I always need an heroku addon to add my SSL certificates which costs $20/month.
Cloudflare ...
0
votes
1answer
648 views
tor and widecap dns leak
I am using a program that I coded in C#.
All it does is use HttpWebRequest to request some pages and read info from them.
I tried running it through Tor. I installed the Vidalia Bundle and Widecap.
My ...
1
vote
1answer
127 views
How does http://un****-us.com/ work?
There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy ...
-1
votes
1answer
170 views
Is .bank owned by banking industry or not? [closed]
According to https://idc-insights-community.com/financial/financial-services-technology/the-four-letter-word-that-could-change-the-busines
Banking Industry was lobbying for .bank
But as I read this
...
0
votes
1answer
80 views
linux accept connection based on request [closed]
I don't know if this is even possible...
I have a single static IP and 3 servers connected to the router. 1 server is Ubuntu Linux with an SSH server. 6 or 8 domain names are linked to my 1 static IP. ...
3
votes
3answers
246 views
Are there DNS analysis tools that could detect bad DNS results?
Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results?
It would be very simply to detect an attack along the ...
1
vote
2answers
1k views
DDoS Protection for DNS providers
Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
4
votes
1answer
192 views
Does deliberately wrong information from a DNS server violate standards generally accepted good practices?
For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up.
This is related ...
3
votes
1answer
133 views
Can NSEC domain enumeration happen for zones with wildcard records?
In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
2
votes
2answers
832 views
Is there any disadvantage in using OpenNIC for DNS resolution?
What are the advantages/disadvantages of OpenNIC vs ISP for DNS resolution with regards to security and privacy?
3
votes
2answers
503 views
How does DNS Changer malware detection work?
This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
1
vote
1answer
749 views
Is it safe to use namebench?
As the title states is Google's namebench utility safe to run on my Mac and let it use Safari's web history?
0
votes
1answer
262 views
OpenDNS vs Dyn Internet Guide [closed]
Inspired by this question I have been looking for alternatives to my ISP's DNS servers. OpenDNS is mentioned quite a bit (as well as Google's DNS, which being Google I have an issue trusting).
I have ...
5
votes
2answers
467 views
Could somebody explain how DNS poisoning might occur in this scenario?
I read the following statement in a security blog
using the same source port over and over again for dns queries instead of randomizing them is a vulnerability for dns poisoning
Could somebody ...
1
vote
1answer
242 views
DNS query through squid? [closed]
My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible?
Snort Alert:
ET POLICY ...
1
vote
1answer
101 views
Reliability of DNSBLs for Stopping Forum Spam
I know that certain DNS blacklists are considered more reliable than others, in that they don't have as many false positives.
I run a forum that is known to be spammed, and I've installed a mod to ...
