The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

4
votes
1answer
86 views

I just deployed DNSSec. Is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSec at https://val-id.com and https://getvalid.com Since DNSSec is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by ...
3
votes
4answers
263 views

Why isn't there a Global Root for SSL?

I was just wondering why there is a file on your computer implementing the trusted root CA's instead of something similar to DNS where there is a file on root servers that computers check against to ...
3
votes
2answers
4k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
3
votes
5answers
797 views

Alternatives for DNS resolution

I was told it's a good idea not to use your ISP to resolve DNS, both for privacy issues and because it can be slow. So I wanted to change, but I've read criticism on using OpenDNS (who makes money on ...
3
votes
3answers
169 views

How to determine if resolved ip is rogue or part of CDN?

I'm subscribed to goverment's owned ISP because only this ISP provides access to rural area. It has a bad reputation because it is not only redirects sites, but also injects JavaScript for ...
3
votes
2answers
2k views

Is it less secure to use OpenDNS for banking accounts, SSH, Adsense account?

I have one WiFi connection in my house which I use for my iPad, phone and computers. I want to block adult sites, time consuming sites for every device that use the WiFi connection. So I came across ...
3
votes
1answer
105 views

Is DNSSEC really useless if TLS is properly configured?

I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
3
votes
1answer
89 views

Google DNS query pointing at ISP instead of Google

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, ...
3
votes
1answer
251 views

Can it be dangerous to use not popular(unknown) dns servers?

There is a service called tunlr, which let's you browse the web with no restrictions(Pandora, Hulu etc.). You just have to use their dns server. But now I'm concerned whether the owners of the dns ...
3
votes
2answers
72 views

A question regarding DNS attacks

When would a DNS attack actually happen? Is it already possible when i connect my pc to the router which is connected to my isp's modem and has received their DNS servers, or later when i am trying ...
3
votes
1answer
1k views

What is a DNS leak?

I'm planning on getting a VPN service (probably Privateinternetaccess) and read that it is imperative to plug DNS leaks. The only information I found on google describing what these are is here and I ...
3
votes
1answer
273 views

Is this the end of malware use of DNS?

I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware ...
3
votes
1answer
550 views

How does a client know that a DNS zone is DNSSEC protected?

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter. However, I have a question to ...
3
votes
1answer
507 views

Why is a separate reconnaissance server needed for DNS cache poisoning?

I'm trying to understand how Metasploit's DNS BailiWicked Host Attack module works. One of the required module options is a "reconnaissance" nameserver (option RECONS). What I understand from the ...
3
votes
2answers
279 views

Unecrypted connection to server - safe?

I am using heroku and cloudflare. I am going to release my website but I don't want do it without SSL. Now I always need an heroku addon to add my SSL certificates which costs $20/month. Cloudflare ...
3
votes
1answer
165 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? v=spf1 include:_spf.google.com ~all v=spf1 include:spf.mandrillapp.com ~all v=spf1 include:servers.mcsv.net ~all Can it ...
3
votes
1answer
206 views

Is a ptr mechanism in an SPF record secure?

If I understand http://www.openspf.org/SPF_Record_Syntax correctly, any machine with an IP that points to my-domain.com can send email as if it's from my-domain.com if I'm using ptr in my SPF record. ...
3
votes
4answers
2k views

Can DNS servers log users requests for commercial use (e.g. track direct access to websites)?

How does it work? For example, could OpenDNS be tracking everything (source ip + requested url) and then selling it to who have the necessary information to correlate the ip addresses with people ...
3
votes
2answers
820 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
1answer
52 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
3
votes
2answers
107 views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network ...
3
votes
1answer
506 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
3
votes
3answers
209 views

Are IPs and domains in malwaredomainlist.com compromised?

I did an nmap scan on a website that is being hosted by a hosting company. The results showed a rDNS record with an ip and a domain name. When I googled the domain name it appeared in ...
3
votes
2answers
146 views

Which is the best antidote for DNS cache poisoning?

I know some antidotes for DNS cache poisoning attacks, both simple as port randomisation, and more complex as DNSSEC. But, which is the more effective? Which solutions are really deployed in the ...
3
votes
2answers
374 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
3
votes
1answer
510 views

captive portal wikipedia article

Something on the wikipedia page regarding captive portals have confused me: http://en.wikipedia.org/wiki/Captive_portal When a client requests a website, DNS is queried by the browser. The ...
3
votes
1answer
31 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
3
votes
1answer
76 views

Is DNS leak really an issue?

I'm reading about DNS leak and what threat it can pose to VPN users, for instance, this question. But generally, there's tons of similar topics on the internet. But what are people afraid of? I just ...
3
votes
2answers
43 views

Why gethosbyname() is as bad as gets() by design?

I know gethosbyname() has been obsolete for a long time. But I see static analysers report its use as unsafe, and when softwares remove its usage, it tends to be for security reasons. I know there ...
3
votes
1answer
41 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
3
votes
2answers
70 views

Is it possible to take over the victim's system only by DNS attacks?

I found this article and it describes some DNS attacks. Those are mainly targeting login credentials, banking information, and so forth. By redirecting the victim to a malicious site it could be also ...
3
votes
1answer
528 views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
3
votes
1answer
121 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip) I'm also unclear if this ...
3
votes
1answer
57 views

Wildcard DNS entry from a security PoV

We are going to release our new product which will have customers create their own subdomains. This requires having a wildcard DNS on our main domain (We have no other options, right?) Are there any ...
3
votes
2answers
4k views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...
3
votes
1answer
33 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
3
votes
0answers
84 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
3
votes
0answers
56 views

Does DNSSEC still have the “enumerate all names in zone” problem?

According to Wikipedia: DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone ...
3
votes
0answers
119 views

Why would home routers accept incoming DNS traffic?

I stumbled upon an interesting paper (PDF Link) where researchers found out that more than 58% of the DNS open resolvers that are blamed in DDoS attacks are in fact home routers distributed by ISPs to ...
3
votes
2answers
134 views

How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)?

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable. Now I want to check my ...
2
votes
2answers
10k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
2
votes
2answers
787 views

Is it a real security benefit if a host uses static IP Addresses for authentication?

As my knowledge about information security is not THAT good and Google did not give me a satisfactory answer I would like to ask the community here: I am working for a company offering online ...
2
votes
2answers
435 views

Might Google log every website I visit using Chrome?

I wanted to start using Chrome for quite some time now, but I really don't want to tell Google about whatever sites I visit. So I was wondering if Chrome sends any data to Google telling them what ...
2
votes
1answer
9k views

How to test for zone transfer? [duplicate]

I heard that it is possible to test for zone transfer attacks on a web application using host and dig commands in Linux. How it is done?
2
votes
1answer
57 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
2
votes
1answer
2k views

Is DNS service secure?

I am based outside of the US, but I still want to watch Netflix. So I am thinking about signing up a DNS service such as unblocked-us, but I worry that as I am now querying an unknown ( relative to ...
2
votes
1answer
65 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android ...
2
votes
1answer
45 views

Detect host lookups against a domain/subdomain name

I want to detect, with as much accuracy as possible, the IP address of any remote host performing a DNS lookup of my domain name (eg. nslookup mydomain123.com) and any subdomains as well if possible. ...
2
votes
5answers
274 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
2
votes
4answers
240 views

New gTLDs are coming. How will browsers handle cookies, SOP and certificates?

Given that the security "zone" varies based on the TLD, how will the new TLS be handled? For example: A browser may permit cookies to be shared and SSL certificates, and wildcard certificates ...