The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

1
vote
1answer
218 views

How does http://un****-us.com/ work?

There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy ...
-1
votes
1answer
186 views

Is .bank owned by banking industry or not? [closed]

According to https://idc-insights-community.com/financial/financial-services-technology/the-four-letter-word-that-could-change-the-busines Banking Industry was lobbying for .bank But as I read this ...
4
votes
3answers
575 views

Are there DNS analysis tools that could detect bad DNS results?

Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results? It would be very simply to detect an attack along the ...
2
votes
2answers
2k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
4
votes
1answer
303 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
4
votes
1answer
308 views

Can NSEC domain enumeration happen for zones with wildcard records?

In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
3
votes
2answers
5k views

Is there any disadvantage in using OpenNIC for DNS resolution?

What are the advantages/disadvantages of OpenNIC vs ISP for DNS resolution with regards to security and privacy?
3
votes
2answers
646 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
1
vote
1answer
2k views

Is it safe to use namebench?

As the title states is Google's namebench utility safe to run on my Mac and let it use Safari's web history?
6
votes
2answers
1k views

Could somebody explain how DNS poisoning might occur in this scenario?

I read the following statement in a security blog using the same source port over and over again for dns queries instead of randomizing them is a vulnerability for dns poisoning Could somebody ...
1
vote
1answer
361 views

DNS query through squid? [closed]

My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible? Snort Alert: ET POLICY ...
1
vote
1answer
140 views

Reliability of DNSBLs for Stopping Forum Spam

I know that certain DNS blacklists are considered more reliable than others, in that they don't have as many false positives. I run a forum that is known to be spammed, and I've installed a mod to ...
4
votes
3answers
1k views

Does DNS pinning protect against all DNS rebinding attack?

I found an example of a DNS rebinding attack scenario in the paper "Dynamic Pharming Attacks and Locked Same-origin Policies for Web Browsers". Figure 1: An example of a dynamic pharming attack ...
4
votes
5answers
19k views

If I use a VPN, who will resolve my DNS requests?

Will they be resolved by my VPN provider, or by my original ISP (if left on "automatic" settings)? Would I have to manually configure a dns server, to make sure my requests will not be resolved by my ...
6
votes
7answers
19k views

Are services like Hide My Ass and UnoDNS reasonably safe to use?

While in Germany, I want to keep using my Netflix account, watch PBS, CNBC. I have found following services: A VPN: https://hidemyass.com/vpn/promo/1/5/ A DNS: http://www.unotelly.com/unodns/ I an ...
20
votes
6answers
3k views

Why do DDoS attacks cost a fortune to stop?

I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions: Is this because they try to keep the servers accessible to real site ...
1
vote
1answer
3k views

What are the risks of removing ISATAP from the default global block list?

The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command: dnscmd /config ...
5
votes
1answer
213 views

Kaminsky Bug Exploitation

I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that ...
2
votes
3answers
4k views

How does bidirectional authentication using SSL work?

Let's say Alice wants to use a webservice on Bob. Bob is on bob.in.wonderland.com Alice opens a connections to bob.in.wonderland.com:443. Taken by DNS magic rabbit, Alice arrives on port 443 at ...
9
votes
3answers
2k views

DNSSec (comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that comcast has switched over to DNSSec:Comcast DNSSec. I've did a little research on DNSSec and its benefits. I ...
5
votes
2answers
6k views

How can I detect/withstand DNS amplification attack?

I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
3
votes
2answers
931 views

Is it less secure to use OpenDNS for banking accounts, SSH, Adsense account?

I have one WiFi connection in my house which I use for my iPad, phone and computers. I want to block adult sites, time consuming sites for every device that use the WiFi connection. So I came across ...
0
votes
3answers
557 views

DNS queries with hex string that is a SHA1 of a domain name! Is it a malware?

My computer does a lot of queries to strange domains such as: 56cea5c2b408989ab067adcb787d0f99209bbe07.mydomain.com The strange thing is that 56cea5c2b408989ab067adcb787d0f99209bbe07 is the SHA1 of ...
13
votes
4answers
4k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
5
votes
4answers
444 views

Is it harmful to redirect web bugs to localhost on hosts file?

I was checking the article hosts file on Wikipedia, and I found this: Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
1
vote
1answer
1k views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
1
vote
1answer
128 views

DNS Cache poisioning examples, or other criteria when a client ignores a response

Is there a concise set of rules that describe what 99% percent of DNS responders accept? Conversely, are there are set of rules that define when DNS queries are invalid? Example answer I would ...
-1
votes
3answers
348 views

Available alternative DNS protocol not another dark-net [closed]

Hi does any one knows any DNS alternative Protocols ? If so what is the most used ? Is easy to setup ? Is easy to have two DNS protocols one where you connect to the Common Internet and the other ...
7
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
8
votes
2answers
10k views

DNS zone transfer attack

Hello Guys! Can anyone explain what is DNS zone transfer or give any link, paper? I have already googled, but could not find anything meaningful?
3
votes
1answer
382 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
0
votes
2answers
911 views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
4
votes
2answers
2k views

DNS Spoofing vs ARP spoofing, the relationship?

As I understand, ARP spoofing can only be done on the LAN-side of the router? DNS spoofing, can that be done either side of the router? In order to do DNS spoofing, do you need to perform ARP ...
3
votes
1answer
229 views

How exactly would SOPA-style DNS blocking threaten the security of the Internet?

A point that keeps getting mentioned in the SOPA debate is that the DNS blocking it prescribes will cause security problems. Can somebody explain in simple terms just exactly how SOPA threatens ...
2
votes
2answers
4k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
5
votes
3answers
566 views

How dangerous is it that there are DNS entries for our domain that we did not register?

I was performing an DNS brute-force on our company's domain and found entries like "html" "ww" and "wwww" resolving to IPs outside of our registered block. This sparked a debate about just how ...
3
votes
2answers
5k views

Listing of DNS vulnerabilities

I am currently studying how to setup DNS servers and all aspects of the DNS system. I would also like to study the security aspect. I want to use current DNS server attack on my test servers. Is there ...
6
votes
3answers
562 views

Is the Kaminsky bug still a problem for sites without DNSSEC?

I have read about the Kaminsky bug, but I don't fully understand how easy it is to use this vulnerability for an attacker. Are DNS-software updated now so it's not that easy to use this vulnerability ...
-1
votes
1answer
361 views

How does DNS work?

I'm learning pentesting from books. So far I thought I know about DNS but now I'm completely lost and confused. well, I know what happens when you enter domain name in your browser: Say, I've ...
1
vote
3answers
565 views

Preventing 3rd party DNS Servers from being used

While using a wireless network recently that implemented a captive gateway, I noticed that any third party DNS servers manually set would not allow the network to connect properly. This would seem ...
5
votes
1answer
2k views

Implications of using DNS Forwarders instead of Root Hints

When redesigning an organizations DNS infrastructure, the question of using Forwarders instead of Root Hints comes up. What kinds of issues should I be aware of when the admins and designers start ...
5
votes
1answer
226 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
4
votes
5answers
581 views

Alternatives for DNS resolution

I was told it's a good idea not to use your ISP to resolve DNS, both for privacy issues and because it can be slow. So I wanted to change, but I've read criticism on using OpenDNS (who makes money on ...
1
vote
1answer
588 views

Should Windows 2008 R2 be used as an externally facing DNS name server?

When compared to more traditional DNS name servers, what are the benefits / drawbacks of using a Windows 2008 R2 as a public ns record for a company. What limitations, or security issues would I ...
4
votes
1answer
242 views

My DNS Name Server does not support DNSSec client queries, what alternatives do I have?

I am using a web browser to access DNSSec enabled sites. My current name server doesn't (won't) support DNSSec for at least a year. What are my alternatives? Do any ISPs currently offer DNSSec? ...
4
votes
1answer
191 views

How will users know if their session is DNSSec protected or not?

There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure. Ultimately I would like my users to recognize that ...
0
votes
1answer
2k views

Is OpenVPN secure in this way?

I'm familiar with OpenVPN because my home router has a builtin OpenVPN server. I would like to use OpenVPN all the time, but how do I deal with situations where I don't own the routers? ex.: in a ...
10
votes
4answers
3k views

Is NTP vulnerable to DNS poisoning or spoofing attacks?

Scenario: Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application) Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
6
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
6
votes
2answers
2k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...