The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

2
votes
2answers
195 views

Google DNS in Firewall logs

I was viewing my firewall logs and come across the IP 8.8.8.8. Further check reveals it belongs to Google DNS. And such traffic has been going out from some of our LAN segment PCs. From here on, how ...
2
votes
2answers
587 views

Is it a real security benefit if a host uses static IP Addresses for authentication?

As my knowledge about information security is not THAT good and Google did not give me a satisfactory answer I would like to ask the community here: I am working for a company offering online ...
2
votes
2answers
2k views

How does DigitalOcean DNS verify the owner of a domain?

Say you purchase a domain on Namecheap, but want to host DNS on DigitalOcean. DigitalOcean, says to simply tell your registrar to use DO's nameservers, then set up your DNS for that domain on DO. ...
2
votes
1answer
2k views

Is DNS service secure?

I am based outside of the US, but I still want to watch Netflix. So I am thinking about signing up a DNS service such as unblocked-us, but I worry that as I am now querying an unknown ( relative to ...
2
votes
4answers
211 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...
2
votes
1answer
820 views

What is a DNS leak?

I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
2
votes
3answers
5k views

How does bidirectional authentication using SSL work?

Let's say Alice wants to use a webservice on Bob. Bob is on bob.in.wonderland.com Alice opens a connections to bob.in.wonderland.com:443. Taken by DNS magic rabbit, Alice arrives on port 443 at ...
2
votes
4answers
2k views

What can and can't a malicious DNS do?

I have been thinking of using http://tunlr.net/ for accessing "geo-IP banned websites" like netflix. However, I have my concerns about safety of using some third party DNS server for everything. So, ...
2
votes
1answer
2k views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
2
votes
2answers
242 views

Defence against promiscuous detection techniques

As an attacker,how do I prevent people from finding out that my NIC is in promiscuous mode? For test like ARP and DNS how do I defeat the users detection mechanism?
2
votes
1answer
51 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
2
votes
3answers
877 views

Can DNS servers log users requests for commercial use (e.g. track direct access to websites)?

How does it work? For example, could OpenDNS be tracking everything (source ip + requested url) and then selling it to who have the necessary information to correlate the ip addresses with people ...
2
votes
1answer
157 views

Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately?

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore ...
2
votes
4answers
531 views

Can ISPs log IP connections?

I know most, if not all, ISPs log the IPs you had tied to your network, but do ISPs keep logs of the IPs you have tried to connect to? For example, let's say I went to google.com, would the ISP be ...
2
votes
1answer
772 views

What is Open Resolver Project and how does it solve DNS reflection attacks?

What is Open Resolver Project and how does it give a solution for DNS reflection attack? I also read that Open Resolver Project follows BCP38. What is BCP38?
2
votes
1answer
288 views

Should the email address in the SOA be used to validate domain control?

I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as Email validation of Whois contacts Access to the ...
2
votes
2answers
244 views

DNS access limitations

Im working on a script that's going to talk to a DNS on a LAN that have information about local domains. And I believe its blocking my requests. So my question is: How can you limit a DNS server to ...
2
votes
2answers
130 views

What can my ISP see in their log files if I use Google DNS?

For example, if I use my ISP DNS and open this page they will see: http://security.stackexchange.com/questions/ask It would show up in their logs for sure. But if I use Google DNS, then what ...
2
votes
1answer
41 views

Abnormal SYN traffic from Blackhole DNS servers

I have been getting alerts from an anomaly based signatures for abnormally high SYN traffic. The traffic is coming from blackhole DNS servers. I hadn't had any experience with Blackhole servers prior ...
2
votes
1answer
49 views

Does any DNS Recursive resolver accept a “DNSSEC-only” option under DNSCurve?

I want to use DNSCurve (for privacy) to a trusted DNSSec resolver (for integrity), and want to ensure that I can tell a recursive resolver (like 8.8.8.8, or OpenDNS) that I only want DNSSec queries. ...
2
votes
1answer
108 views

Conversant, CNAME, Cookies, and PCI complaince

We have been asked to evaluate Conversant Tracking. http://www.conversantmedia.com/solutions/enterprise-solutions From what I can tell its pretty straight forward tracking, like google re-marketing, ...
2
votes
1answer
1k views

How to verify DNSKEY by using its corresponding DS

A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR. The ...
2
votes
1answer
133 views

How did DNSChanger rogue name servers work?

I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites ...
2
votes
1answer
136 views

DNS Cache poisioning examples, or other criteria when a client ignores a response

Is there a concise set of rules that describe what 99% percent of DNS responders accept? Conversely, are there are set of rules that define when DNS queries are invalid? I would think that the ...
2
votes
1answer
116 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
2
votes
5answers
781 views

What is the best way to run MitM attack on my wireless network?

For research purpose, I want to launch a MitM attack on computers that are connected to my wireless network. I wonder what is the best way to do so. Notice that I control the router, and do not want ...
2
votes
1answer
361 views

DNS: Conditional Forwarding

I'm currently attempting to track down a problem with a Websense Web Filter breaking SSL connections for sites in a conditional forward. To do this, I need to know exactly how a conditional forward ...
2
votes
2answers
390 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
2
votes
0answers
56 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
2
votes
0answers
64 views

DNS poisoned cache does not have any effect [closed]

I try to reproduce the attack, revealed by Dan Kaminsky in 2008, to poison DNS cache. I made my own virtual network, and all I do is confined within. The poisonning seems to work. But is doesn't. ...
2
votes
1answer
806 views

External network DNS spoofing

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios: 1. ...
2
votes
0answers
1k views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
1
vote
2answers
672 views

How can I stop someone to display my website with his domain?

I just discovered on a website that someone is pointing a DNS on the server I use for a website, and by this mean, is displaying the website of "my" server. How can I stop this unlegitimate use of ...
1
vote
3answers
125 views

Are different top level domains somehow different security wise?

If so why is the difference? I've tried to google it but nothing relevant was found.
1
vote
2answers
279 views

anti virus acting up/DNS poisoning

I was running my desktop and the AV deleted a file that it said was a virus (this was not during a scan, just normal usage). Now I'm just browsing the web and I got a couple of DNS poisoning attacks ...
1
vote
3answers
729 views

Preventing 3rd party DNS Servers from being used

While using a wireless network recently that implemented a captive gateway, I noticed that any third party DNS servers manually set would not allow the network to connect properly. This would seem ...
1
vote
2answers
79 views

Difference between DNS spoofing and phishing [closed]

I am writing a bachelor thesis and I am having a hard time figuring out the difference between phishing and DNS spoofing. From what I understand, DNS spoofing is a way to achieve a succesfull phishing ...
1
vote
2answers
145 views

Roommate Frequently Hacked — How Do I Protect My Network/Devices?

If you absolutely had to share a network with a user who had a very lax approach to security and was frequently hacked (1-2x month for over a year now), what might you consider doing to secure your ...
1
vote
1answer
91 views

Force DNS to attach bad IP address

The question is not professional, but what I'm trying to say is... Is there any way to inject or force the DNS server to attach/change an IP address for some site. For example, I'm running an apache ...
1
vote
1answer
87 views

DNS Redelegation - Security Risk?

I am a web developer and I use Adobe Business Catalyst. To use some of their services it is recommended you redelegate the domain. In other words change the nameservers to Business Catalyst. I have ...
1
vote
1answer
413 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
1
vote
1answer
255 views

How does http://un****-us.com/ work?

There is this site un**-us.com which supposedly allows you to bypass ISP rules such as content restriction on a particular area. Now , it is well known that routing your traffic through a web proxy ...
1
vote
1answer
4k views

What are the risks of removing ISATAP from the default global block list?

The process of installing Microsofts pseudo VPN called Direct Access requires me to remove the ISATAP name from the default global block list by running this command: dnscmd /config ...
1
vote
2answers
80 views

Using DNS to track browser activity on a LAN

I am trying to create a small network auditing script that tracks HTTP and HTTPS domain names visited by certain hosts using the libpcap wrapper for Nodejs. At its best the script would be able to ...
1
vote
2answers
172 views

What can my university see by installing a CA root certificate on my computer, even when I'm using a VPN?

To use the wifi at my university, you must install a CA root certificate by them. In my case, I am using a Mac computer with a VPN installed. I'm curious, what can they see me do on my computer by ...
1
vote
3answers
870 views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
1
vote
2answers
733 views

Way to make “DNS unblockers” safe?

Many people who live outside the US use "DNS unblockers" such as Unblock-Us to access region restricted services such as Netflix and Hulu. My understanding of these services is that for DNS requests ...
1
vote
1answer
143 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
1
vote
2answers
4k views

Anyone out there using Umbrella from OpenDNS? What exactly is it?

I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to ...
1
vote
2answers
111 views

Using free subdomains to circumvent web filtering systems

(I was told that this was the place to ask this by someone from Webmasters, if I've got it wrong again please give me a chance!) I'm running a personal proxy service for the use of myself and some of ...