The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

4
votes
3answers
491 views

Are there DNS analysis tools that could detect bad DNS results?

Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results? It would be very simply to detect an attack along the ...
4
votes
1answer
273 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
4
votes
1answer
143 views

When should a DNS entry be cached? What conditions should not be? How do I determine the TTL?

I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least). Is there consolidated test ...
3
votes
3answers
3k views

To DMZ, or not to DMZ

So for an assignment, we need to create a scheme (and eventually also the set-up) of a couple of servers in a network. The 'networks' are: Internal network DMZ The internet And the servers we ...
3
votes
2answers
1k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
3
votes
2answers
4k views

Is there any disadvantage in using OpenNIC for DNS resolution?

What are the advantages/disadvantages of OpenNIC vs ISP for DNS resolution with regards to security and privacy?
3
votes
2answers
796 views

Is it less secure to use OpenDNS for banking accounts, SSH, Adsense account?

I have one WiFi connection in my house which I use for my iPad, phone and computers. I want to block adult sites, time consuming sites for every device that use the WiFi connection. So I came across ...
3
votes
1answer
229 views

How exactly would SOPA-style DNS blocking threaten the security of the Internet?

A point that keeps getting mentioned in the SOPA debate is that the DNS blocking it prescribes will cause security problems. Can somebody explain in simple terms just exactly how SOPA threatens ...
3
votes
1answer
180 views

How will users know if their session is DNSSec protected or not?

There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure. Ultimately I would like my users to recognize that ...
3
votes
1answer
225 views

Why is a separate reconnaissance server needed for DNS cache poisoning?

I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS). What I understand from the ...
3
votes
2answers
191 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
3
votes
2answers
4k views

Listing of DNS vulnerabilities

I am currently studying how to setup DNS servers and all aspects of the DNS system. I would also like to study the security aspect. I want to use current DNS server attack on my test servers. Is there ...
3
votes
2answers
586 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
2answers
1k views

DNS Spoofing vs ARP spoofing, the relationship?

As I understand, ARP spoofing can only be done on the LAN-side of the router? DNS spoofing, can that be done either side of the router? In order to do DNS spoofing, do you need to perform ARP ...
3
votes
1answer
363 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
3
votes
1answer
257 views

Can NSEC domain enumeration happen for zones with wildcard records?

In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
2
votes
4answers
683 views

Does using Google DNS make extensions like AdBlock Plus useless?

As many of you probably do, I am not using my ISP DNS because of very low performance, and I am using Google's primary and secondary DNS (8.8.8.8 and 8.8.4.4) which are good speed-wise but, knowing ...
2
votes
4answers
14k views

If I use a VPN, who will resolve my DNS requests?

Will they be resolved by my VPN provider, or by my original ISP (if left on "automatic" settings)? Would I have to manually configure a dns server, to make sure my requests will not be resolved by my ...
2
votes
2answers
2k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
2
votes
4answers
194 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
2
votes
2answers
115 views

Is it a real security benefit if a host uses static IP Addresses for authentication?

As my knowledge about information security is not THAT good and Google did not give me a satisfactory answer I would like to ask the community here: I am working for a company offering online ...
2
votes
2answers
406 views

How does DigitalOcean DNS verify the owner of a domain?

Say you purchase a domain on Namecheap, but want to host DNS on DigitalOcean. DigitalOcean, says to simply tell your registrar to use DO's nameservers, then set up your DNS for that domain on DO. ...
2
votes
4answers
168 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
2
votes
3answers
3k views

How does bidirectional authentication using SSL work?

Let's say Alice wants to use a webservice on Bob. Bob is on bob.in.wonderland.com Alice opens a connections to bob.in.wonderland.com:443. Taken by DNS magic rabbit, Alice arrives on port 443 at ...
2
votes
4answers
1k views

What can and can't a malicious DNS do?

I have been thinking of using http://tunlr.net/ for accessing "geo-IP banned websites" like netflix. However, I have my concerns about safety of using some third party DNS server for everything. So, ...
2
votes
1answer
102 views

Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately?

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore ...
2
votes
1answer
431 views

What is Open Resolver Project and how does it solve DNS reflection attacks?

What is Open Resolver Project and how does it give a solution for DNS reflection attack? I also read that Open Resolver Project follows BCP38. What is BCP38?
2
votes
1answer
111 views

Should the email address in the SOA be used to validate domain control?

I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as Email validation of Whois contacts Access to the ...
2
votes
1answer
466 views

What is a DNS leak?

I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
2
votes
2answers
211 views

DNS access limitations

Im working on a script that's going to talk to a DNS on a LAN that have information about local domains. And I believe its blocking my requests. So my question is: How can you limit a DNS server to ...
2
votes
1answer
456 views

How to verify DNSKEY by using its corresponding DS

A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR. The ...
2
votes
1answer
118 views

How did DNSChanger rogue name servers work?

I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites ...
2
votes
2answers
291 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
2
votes
1answer
34 views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...
2
votes
0answers
31 views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5, NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for SHA1 ...
2
votes
1answer
366 views

External network DNS spoofing

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios: 1. ...
2
votes
0answers
539 views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
1
vote
3answers
110 views

Are different top level domains somehow different security wise?

If so why is the difference? I've tried to google it but nothing relevant was found.
1
vote
2answers
213 views

anti virus acting up/DNS poisoning

I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks ...
1
vote
2answers
3k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
1
vote
3answers
514 views

Preventing 3rd party DNS Servers from being used

While using a wireless network recently that implemented a captive gateway, I noticed that any third party DNS servers manually set would not allow the network to connect properly. This would seem ...
1
vote
1answer
68 views

DNS Redelegation - Security Risk?

I am a web developer and I use Adobe Business Catalyst. To use some of their services it is recommended you redelegate the domain. In other words change the nameservers to Business Catalyst. I have ...
1
vote
1answer
299 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
1
vote
1answer
203 views

How does http://un****-us.com/ work?

There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy ...
1
vote
4answers
173 views

Can ISPs log IP connections?

I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be ...
1
vote
1answer
73 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
1
vote
1answer
3k views

What are the risks of removing ISATAP from the default global block list?

The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command: dnscmd /config ...
1
vote
1answer
56 views

DNS zone size overload?

Is it possible to DOS DNS by creating custom dns zones with lots of text records in them so that the size of the DNS zone is in the order for example 100 Gigabyes, and then query all the dns records ...
1
vote
1answer
163 views

Following redirects from HTTPS to HTTP - Secure?

So I have an HTTP client which supports HTTPS. However, it doesn't follow the HTTP spec recommendation for redirects on POST(which is to ask the user before redirecting) This means, in theory, if you ...
1
vote
1answer
877 views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...