The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

2
votes
1answer
613 views

What is Open Resolver Project and how does it solve DNS reflection attacks?

What is Open Resolver Project and how does it give a solution for DNS reflection attack? I also read that Open Resolver Project follows BCP38. What is BCP38?
0
votes
2answers
190 views

Can Tor browser bundle be attacked like this?

When using the Tor browser bundle, you load the check.torproject.org on start. It tells you when there is a security update to downloads, and let's you click a link to get it. The way for users to ...
0
votes
1answer
107 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...
1
vote
1answer
148 views

DNS queries to compromise DNS cache

The transaction ID for DNS queries can take values from 1 to 65,536 and my computer pseudorandomly chooses one for each DNS request. If I sents 1,024 false replies per request, how many requests ...
7
votes
2answers
2k views

How can someone sinkhole domains?

The Wikipedia article about CryptoLocker says: In late-October 2013, security vendor Kaspersky Labs reported that with the help of a researcher, it had created a DNS sinkhole to block some of the ...
6
votes
1answer
181 views

Attack on authoritative DNS server with high TTLs

The way DNS works, resolvers cache query results per TTL defined in the response. Consider an authoritative DNS server that is compromised, its main A record set to a different IP and TTL of that ...
5
votes
2answers
633 views

How does dnsleaktest.com find my DNS provider

Can't see how they find this over the web. I'm on Windows, its in my network config. It changes when I use a VPN provider, but not when I use a local socks proxy connected to a remote server over ...
1
vote
1answer
80 views

DNS Redelegation - Security Risk?

I am a web developer and I use Adobe Business Catalyst. To use some of their services it is recommended you redelegate the domain. In other words change the nameservers to Business Catalyst. I have ...
4
votes
4answers
961 views

Does using Google DNS make extensions like AdBlock Plus useless?

As many of you probably do, I am not using my ISP DNS because of very low performance, and I am using Google's primary and secondary DNS (8.8.8.8 and 8.8.4.4) which are good speed-wise but, knowing ...
8
votes
3answers
348 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
1
vote
1answer
532 views

Clear the DNS server's cache?

Is there anyway for the attacker to clear the cache of a DNS server in order to poison it? For example, if someone attacked my DNS server in an attempt to spoof Google.com, they will receive the ...
1
vote
5answers
346 views

Manual DNS change

If I manually change my DNS setting in the router or in Windows settings from the provider's one to, say, 8.8.4.4 by Google - will it mean that my ISP has no idea which sites I am going to? Maybe it ...
2
votes
1answer
183 views

Should the email address in the SOA be used to validate domain control?

I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as Email validation of Whois contacts Access to the ...
2
votes
4answers
192 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
1
vote
1answer
96 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
6
votes
4answers
10k views

Pros/cons of using a private DNS vs. a public DNS

I was wondering why a company should use a private DNS. In comparison with a public DNS, which advantages does a private one have, and which issues can a public DNS create for a company? I'm new at ...
14
votes
5answers
2k views

Can I avoid DNS spoofing by typing the IP address?

The question is in the title. I have been reading about DNS spoofing. What if I were to save the IP addresses of websites I consider sensitive and then just enter the IP address when I am using a ...
5
votes
1answer
2k views

What are the privacy pros and cons of using a public DNS server vs. your own?

Whether I'm using a normal internet connection setup, or tunnelling it through an anonymizing VPN or through TOR, what information of mine is revealed to whatever DNS server that I choose (e.g. Google ...
1
vote
1answer
349 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
2
votes
4answers
1k views

What can and can't a malicious DNS do?

I have been thinking of using http://tunlr.net/ for accessing "geo-IP banned websites" like netflix. However, I have my concerns about safety of using some third party DNS server for everything. So, ...
1
vote
3answers
117 views

Are different top level domains somehow different security wise?

If so why is the difference? I've tried to google it but nothing relevant was found.
5
votes
2answers
2k views

Is it safe to have a DNS record pointing to 127.0.0.1?

My development server is on my local machine (127.0.0.1). I have created an A record in my DNS settings that points dev.mydomain.com to 127.0.0.1 so that I can use this domain name for accessing my ...
6
votes
3answers
494 views

Security implications of an exploited router

So I completely understand that routers and local networks need to be kept locked down, etc. What real security threats can come about from an attacker who has remotely accessed (telnet or web gui) ...
5
votes
5answers
5k views

Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?

I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports. If the all the DNS response go to a Authoritative ...
2
votes
1answer
498 views

External network DNS spoofing

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios: 1. ...
-1
votes
1answer
90 views

Redirect attack [closed]

I just discovered that our server other's website for example: http://destiny.mbtosi.com/styles/new/images/no.png should say "This Web Page no longer exists." but in 50% hits it shows an image from ...
0
votes
1answer
133 views

The importance of changing DNS when Using Antifiltering software

Is it safe that sometimes my Anti-filtering program does not change the DNS address?
1
vote
1answer
226 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
18
votes
3answers
5k views

DNS Amplification DDOS attack

During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
15
votes
7answers
1k views

Would it be possible to overload a large part of the internet, and if so then how?

Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
5
votes
1answer
6k views

DNS Spoofing vs DNS Cache Poisoning

What is the difference between DNS Spoofing and DNS Cache Poisoning ??? It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the ...
4
votes
3answers
5k views

To DMZ, or not to DMZ

So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network. The 'networks' are: Internal network DMZ The internet And the servers we ...
5
votes
3answers
900 views

Why would you want to run DNS servers externally?

Something that's never made much sense to me is when environments have DNS servers which are publicly accessible (on the internet). This more often than not seems to leave them vulnerable to Cache ...
0
votes
1answer
898 views

DNS Cache Poisoning and Snooping

I'm trying to do two things here. The first is poison the cache of a target DNS server. A scan has suggested the network I'm attacking is vulnerable to CVE-1999-0024. My understanding of this ...
3
votes
1answer
304 views

Why is a separate reconnaissance server needed for DNS cache poisoning?

I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS). What I understand from the ...
5
votes
2answers
347 views

Is this a DNS attack?

The following graph shows the UDP DNS queries/sec (blue) and DNS responses/sec (red) of traffic passing a router over the preiod of 4 days. DNS query is a DNS packet with query/response flag set to 0 ...
2
votes
1answer
840 views

How to verify DNSKEY by using its corresponding DS

A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR. The ...
6
votes
1answer
757 views

Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

First, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal ...
1
vote
2answers
3k views

Anyone out there using Umbrella from OpenDNS? What exactly is it?

I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to ...
2
votes
1answer
595 views

What is a DNS leak?

I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
2
votes
2answers
323 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
14
votes
3answers
834 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
23
votes
3answers
883 views

What are some risks of purchasing a “used” domain name

If you purchase an existing domain name that was already used by someone else what are the ways in which the domain could have been broken by the previous owner? Are such problems common and are there ...
8
votes
3answers
18k views

How can I identify open DNS resolvers in my network?

This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
6
votes
1answer
4k views

Which security risks are associated with alternative DNS providers?

I'm considering using an alternative DNS provider on my computer. Which risks do I run if I use one? I already know that the DNS provider may return a malicious IP address when I'm trying to access ...
1
vote
2answers
234 views

anti virus acting up/DNS poisoning

I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks ...
4
votes
2answers
2k views

How do I find all domains hosted on a single host?

I found several websites offer a function that allows you to list all domains hosted on the same machine, e.g you supply a.com, and it tells you b.com and c.com are both hosted on the same machine as ...
6
votes
3answers
659 views

Does NAT break source port randomization?

The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests. Does NAT break the security benefits of source port randomization? In more detail, consider ...
0
votes
1answer
435 views

How have DNS recursion attacks happened?

There are a few resources describing how to carry out DNS recursion attacks. Is there any good explanation to help me understand how these attacks work and if systems on my network are still ...
2
votes
0answers
683 views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...