Tag Info

Hot answers tagged

28

Some common risks to check: Domain has Bad reputation - check for any existing negative online reviews for the domain. Domain is Blocked in search results - Risk of search engine turning off the domain in its search results due to the previous content, malware etc. Domain is Black listed - Domain on black lists such as Web of Trust and spam lists. ...


23

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


20

In order to connect to any website, through https or not, you need the ip address of the site, and you ask your DNS server for it using the domain name of your site. If your DNS server has not cached the answer, it will try to resolve your request by asking a whole series of DNS servers (the root dns server, the top level domain handler ... until the dns ...


19

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


18

This won't work for many websites. Many websites use virtual hosts where they host websites for multiple domains from a single webserver. In this case, the only way they know what site you're coming from is by the hostname your browser sends in the Host header of the HTTP request. The way to do this would be to specifically add these entries into your ...


16

It's because if you shut a server down, you can't use it for revenue. Imagine having a real shop: if you close it during the day, you can't sell anything and offer your services. It's as simple as that. To improve my answer, it costs a lot to fight because it's pretty much impossible to defend yourself against such attacks, since the attacker can use a very ...


15

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


15

First we need to understand what exactly you're asking. Every time someone sends a packet on the Internet it consumes some of the potential bandwidth of the Internet. Just like when a car drives down a road, no other car can drive in that same spot, so you have one less available spot on the road. If we continue that comparison, a single site sending out ...


14

It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...


13

The most systematic answer is to implement split horizon DNS in your infrastructure, such that only internal addresses resolve; clients then must use a proxy server to connect out to the internet, and the proxy server resolves external DNS for them. This is particularly effective if your core network doesn't have a default route, so that packets destined ...


12

It's this simple: If the DDoS attack causes you to shut down, whether by the damage it does directly or by your response to it, then the attacker succeeds. If an attack succeeds, it will be performed every time the attacker wants to succeed. The way to reduce DDoS attacks is to make sure they fail. If a DDoS attack doesn't take the site down, there's no ...


12

DNSSEC and DNSCurve address completely different aspects of DNS security. First of all, DNSSEC does NOT sign your queries. Rather DNSSEC allows a zone (such as a domain) to be signed by its owner, and allows a resolver (for instance, Comcast's DNS servers) to verify the signature, and therefore be sure that the zone data it gets is authentic. It protects ...


12

DNSSec is normal DNS, but with signatures. It absolutely prevents DNS Spoofing; that's what it's for, and that's what it does. Registrars can still theoretically abuse their position because they're responsible for communicating your intentions to the root servers. This includes information about your DNSSec keys. This relationship will never change; if ...


11

Another aspect to the cost for a company, besides lost revenue, is the cost of investigating, verifying, and responding to such attacks. There are conversations with ISPs, combing through log files, re-writing firewall rules, communicating with customers, then postmortems. But note that a company cannot 'stop' the attack, they can only weather it. ...


11

Depending on how your VPN is configured, you might or might not use the same DNS for your VPN and for Internet. VPN's are (typically) like an additional IP stack on your system, and can have a separate DNS server address configured. But not all systems do this. If your VPN does not assign a new DNS for the VPN session then you will continue to use the DNS ...


11

In addition to the ones mentioned already, the previous owner may have a SSL certificate that may still be valid. That would be a major issue especially for sites dealing with commerce.


11

From the source of https://www.dnsleaktest.com/: <iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe> ...


10

DNS Zone transfer is the process where a DNS server passes a copy of part of it's database (a zone) to another DNS server. It's how you can have more than one DNS server able to answer queries about a particular zone; there is a Master DNS server, and Slave DNS servers, and the slave asks he master for a copy of the records for that zone. A basic DNS Zone ...


10

Detection The goal of a reflected DNS attack is to send large volumes of network traffic at a host in order to cause legitimate traffic to be dropped. It is chosen when the attacker doesn't control enough bandwidth himself to exceed the target's bandwidth. It is largely irrelevant whether the target is running a DNS server or not as the damage is usually ...


10

There is a RFC for that. It is part of what DNSSEC is meant to do. Now don't get too hopeful about "top dollar" or reduction thereof. The need to "certify" in some way public keys with regards to server names is not magically removed by switching to DNSSEC. The "CA" role is just moved around, and the associated costs are still there. It can be predicted ...


10

You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...


9

What measures could be recommended to such providers It's situational, it depends on the existing server and network infrastructure, and what magnitude of DDoS attack they're looking to protect against. Existing DNS providers have publicized some of their solutions: easyDNS suffered major DDoS attacks in 2005, and have since blogged about what they ...


9

Check out The Penetration Testing Execution Standard (PTES). And in particular: http://www.pentest-standard.org/index.php/Intelligence_Gathering This video may interest you as well: http://www.irongeek.com/i.php?page=videos/osint-cyberstalking-footprinting-recon#DNS,_Whois_and_Domain_Tools_Finding_general_Information_about_an_organization_via_the_web (from ...


8

The "Kaminsky bug" (CVE-2008-1447) affects "BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1".


8

Since DNS usually runs over UDP, response packets can be readily spoofed. UDP packets are identified by the combination of source and destination IP address and source and destination port numbers. The classic DNS poisoning attack is to send a DNS server a query which you think will cause the server to do a recursive lookup, and then blast away at the ...


8

Most likely not. IPv6 support is still quite patchy in many parts of the world. The delay is most likely caused by bad routing or network packets having to go through too many hops. You can test out your IPv6 connection here. The hosts file is used to bypass DNS and make your access to websites matching domains listed slightly faster, not slower. A whois ...


7

If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept. Also, the other way around, you can configure your OpenVPN client to use an SSL certificate ...


7

Can't recall the name, but I know there's been at least one commercial product which used port 53 to phone home (not a full TCP/IP tunnel though). I would seriously question the (f)utility of trying to prevent this kind of thing by attempting to block specific outbound traffic though. Firewalls were never intended to filter outbound traffic, tunnels, ...


7

I strongly believe that the pure usage of DNSSEC should not be indicated to the user at all. DNSSEC just ensures that the DNS lookups are not tampered with by third (fourth?) parties. DNSSEC does not ensure that the connection is really established with the returned IP-address nor that no attacker is listening in on the data. So pure DNSSEC is way too ...


7

No. Of course not. The privacy-specific purpose of adblock, ghostery, etc., is to prevent your identity on one site from being easily associated with your identity on another site, by the use of cookies, page widgets, referrer identification, etc. Whether or not this protects your actual real-world privacy in any meaningful way is seriously suspect, ...



Only top voted, non community-wiki answers of a minimum length are eligible