Tag Info

New answers tagged

0

New domain spaces often have a pre register period where you can reserve a domain. If they get multiple requests for one domain they can check how has rights for this domain. Otherwise big companies will sue you and give you some money to go away.


1

They also have the resources to sue the pants off anyone who happens to register one. Take a look at bitsquatting and typosquatting, those are about as close as people are likely to get.


2

It's all about recon. The more an attacker can map your network, the better off they are. This can be especially sensitive if you have static IP's that don't move around. DNS servers, given you do not separate out recursive services from SOA (given you have any), can be used for various attacks that will affect hosts on your network such as cache ...


1

Yes! If your server is a recursive server, block ALL queries from unknown/untrusted sources, regardless of source port. You should also block queries, even from trusted sources, with a source port of 53. If your server is an authoritative server, yes, you should still block queries with a source port of 53. In fact, you should block queries with any ...


1

DNSSec does not prevent against MITM attacks. This is also mentioned in the following answer and a bit more explanation of how DNSSec works and some of its limitations. In this paper author discusses ways to circumvent DNSSec in Section VI, including 'intruder-in-the-middle' attack.


1

A conditional forward is SPECIFIC to a domain being queried at the end of the day. Let's model this: YOUR COMPANY yourco.com finance.yourco.com mrkting.yourco.com Internet yahoo.com google.com blogger.com Internet.Misc login.yahoo.com We have your company three websites, and a specific Yahoo site. When a machine makes a query from say your network: ...


2

You can do it if you want to. Go ahead. No? Why haven't you switched yet? Yep, there's the problem. Nobody else switched. If you change the rules, you're effectively creating a different Internet. One that isn't entirely compatible with the Internet we all have, which means nobody is on it but you. This Internet, the one we're using right now, works well ...


0

Blocking all originating traffic with source port 53 will not solve your issue. DNS Amplification attack is sort of a volumatric DDOS attack, no matter how good your firewall can block/handle the bad traffic, your pipeline will still be bursted. You want to block the DNS spoof traffics as close to the internet edge as possible. Try contact the ISP for ...


1

Something like this? Probably caused by the load balancing techniques used by Facebook. Essentially, when your computer issues a DNS request to your local DNS server (usually the one run by your ISP), it in turn contacts the authoritative DNS servers for the Facebook domain. Those servers in turn direct the DNS request to Akamai DNS servers, which return ...


1

It Certainly would reduce the exposure and increase the obscurity of the connection to narrow the possible connections to a small sub group of specific IP addresses. What would be a safer approach is to have your users connect to a VPN endpoint and then connect to that system from there, This obfuscates the traffic with encryption and makes it un-viewable ...


6

I'd say that there can be a benefit from using static IP addresses. Essentially if at the firewall you can say "only allow traffic to this port from these specific IP addresses" then there are a number of effects. An attacker scanning the Internet for vulnerable hosts is unlikely to detect the service and therefore be able to attack it An attacker who is ...



Top 50 recent answers are included