The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

35
votes
5answers
4k views

What makes Let's Encrypt secure?

Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every ...
23
votes
3answers
898 views

What are some risks of purchasing a “used” domain name

If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there ...
20
votes
6answers
3k views

Why do DDoS attacks cost a fortune to stop?

I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions: Is this because they try to keep the servers accessible to real site ...
18
votes
3answers
6k views

DNS Amplification DDOS attack

During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
17
votes
4answers
700 views

Global Blackout is a myth?

In order to shut the Internet down, anonymous claimed that putting-down the 13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
17
votes
5answers
1k views

How secure is binding to localhost in order to prevent remote connections?

Let's say we're running a service that's bound to localhost (127.0.0.1), and the goal is to only allow local clients (i.e. from the same machine only) What techniques might be used to break this ...
17
votes
5answers
8k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
16
votes
8answers
2k views

Can a HTTPS connection be compromised because of a rogue DNS server

If I'm visiting (just a desktop PC, client side) a site that has a valid HTTPS cert/connection, that can it be compromised if I'm using a rogue DNS server (not deliberately, I'm concerned about an ...
15
votes
7answers
1k views

Would it be possible to overload a large part of the internet, and if so then how?

Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
15
votes
4answers
4k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
14
votes
5answers
2k views

Can I avoid DNS spoofing by typing the IP address?

The question is in the title. I have been reading about DNS spoofing. What if I were to save the IP addresses of websites I consider sensitive and then just enter the IP address when I am using a ...
14
votes
3answers
945 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
13
votes
3answers
3k views

DNSSec (comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that comcast has switched over to DNSSec:Comcast DNSSec. I've did a little research on DNSSec and its benefits. I ...
11
votes
2answers
3k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
11
votes
1answer
245 views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5, NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for SHA1 ...
10
votes
3answers
433 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
10
votes
4answers
4k views

Is NTP vulnerable to DNS poisoning or spoofing attacks?

Scenario: Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application) Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
10
votes
3answers
488 views

External websites in logs [duplicate]

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
9
votes
2answers
15k views

DNS zone transfer attack

Hello Guys! Can anyone explain what is DNS zone transfer or give any link, paper? I have already googled, but could not find anything meaningful?
9
votes
2answers
2k views

Is the Google address being spoofed on my computer?

I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed. I believe that a process has modified some network file on my computer, like ...
9
votes
0answers
725 views

Attackers of Google DNS hijacking

As we know Google DNS server (8.8.8.8) in 14th and 15th March was hijacked in Sao Paulo. And subsequent to this event, BGPmon.org announced an alert. Now, In a course assignment, we are asked to ...
8
votes
3answers
21k views

How can I identify open DNS resolvers in my network?

This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
8
votes
2answers
4k views

How can someone sinkhole domains?

The Wikipedia article about CryptoLocker says: In late-October 2013, security vendor Kaspersky Labs reported that with the help of a researcher, it had created a DNS sinkhole to block some of the ...
7
votes
2answers
2k views

Could somebody explain how DNS poisoning might occur in this scenario?

I read the following statement in a security blog using the same source port over and over again for dns queries instead of randomizing them is a vulnerability for dns poisoning Could somebody ...
7
votes
2answers
447 views

How to protect and detect DNS manipulations from browser side?

After reading the question about a manipulated google analytics script I wonder how you would protect against this kind of attack. What comes to mind is setting DNS IP fixed in network configuration ...
7
votes
4answers
297 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
7
votes
1answer
8k views

DNS Spoofing vs DNS Cache Poisoning

What is the difference between DNS Spoofing and DNS Cache Poisoning ??? It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the ...
7
votes
1answer
1k views

DSL Modem Compromised?

Just found out that the primary & secondary DNS servers have been changed to 95.211.156.101 & 5.45.75.11. I had the following setup in place. MAC filtering and WPA2 for WiFi. ...
7
votes
1answer
333 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
7
votes
2answers
2k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...
6
votes
2answers
914 views

How does dnsleaktest.com find my DNS provider

Can't see how they find this over the web. I'm on Windows, its in my network config. It changes when I use a VPN provider, but not when I use a local socks proxy connected to a remote server over ...
6
votes
3answers
665 views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
6
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
6
votes
7answers
21k views

Are services like Hide My Ass and UnoDNS reasonably safe to use?

While in Germany, I want to keep using my Netflix account, watch PBS, CNBC. I have found following services: A VPN: https://hidemyass.com/vpn/promo/1/5/ A DNS: http://www.unotelly.com/unodns/ I an ...
6
votes
2answers
2k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
6
votes
3answers
2k views

What's involved in taking over someone else's domain name?

I'm asking this for purely academic reasons. I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
6
votes
2answers
8k views

Is there any disadvantage in using OpenNIC for DNS resolution?

What are the advantages/disadvantages of OpenNIC vs ISP for DNS resolution with regards to security and privacy?
6
votes
1answer
121 views

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack works? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
6
votes
4answers
17k views

Pros/cons of using a private DNS vs. a public DNS

I was wondering why a company should use a private DNS. In comparison with a public DNS, which advantages does a private one have, and which issues can a public DNS create for a company? I'm new at ...
6
votes
2answers
3k views

Is it safe to have a DNS record pointing to 127.0.0.1?

My development server is on my local machine (127.0.0.1). I have created an A record in my DNS settings that points dev.mydomain.com to 127.0.0.1 so that I can use this domain name for accessing my ...
6
votes
1answer
6k views

Which security risks are associated with alternative DNS providers?

I'm considering using an alternative DNS provider on my computer. Which risks do I run if I use one? I already know that the DNS provider may return a malicious IP address when I'm trying to access ...
6
votes
3answers
827 views

Does NAT break source port randomization?

The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests. Does NAT break the security benefits of source port randomization? In more detail, consider ...
6
votes
1answer
2k views

What are the privacy pros and cons of using a public DNS server vs. your own?

Whether I'm using a normal internet connection setup, or tunnelling it through an anonymizing VPN or through TOR, what information of mine is revealed to whatever DNS server that I choose (e.g. Google ...
6
votes
3answers
665 views

Is the Kaminsky bug still a problem for sites without DNSSEC?

I have read about the Kaminsky bug, but I don't fully understand how easy it is to use this vulnerability for an attacker. Are DNS-software updated now so it's not that easy to use this vulnerability ...
6
votes
1answer
1k views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
6
votes
1answer
3k views

How to create your own RBL DNS Blacklist to prevent spam

I am getting sick of reporting the same old chinese emails to Spamcop now and would like to make my own small RBL list that I can easily add blocks of IP's to. I have a spare PC and static IP address ...
6
votes
1answer
199 views

Attack on authoritative DNS server with high TTLs

The way DNS works, resolvers cache query results per TTL defined in the response. Consider an authoritative DNS server that is compromised, its main A record set to a different IP and TTL of that ...
5
votes
6answers
6k views

Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?

I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports. If the all the DNS response go to a Authoritative ...
5
votes
3answers
3k views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? ...
5
votes
5answers
34k views

If I use a VPN, who will resolve my DNS requests?

Will they be resolved by my VPN provider, or by my original ISP (if left on "automatic" settings)? Would I have to manually configure a dns server, to make sure my requests will not be resolved by my ...