Tag Info

New answers tagged

1

Short answer Yes it is possible and aside from gpg-checking there are still several possible attacks! To tackle it, I would make sure that the automated update process does at least signature checking, use HTTPS for my repos, and possibly run a validating caching nameserver locally (DNSSEC) like Joe Sniderman suggests All this does still not ensure you ...


-1

It really depends on your threat model. If you are hosting some Wikileaks-grade document, that might be a very real threat. If it's just a casual server on the Internet, you'll just want to update as often as possible way before worrying about this kind of attack.


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...


2

To answer your question, it is possible to spoof the update servers DNS; then, your packet manager should not install unsigned packets, an attacker could send you bad data, but you wouldn't accept it. Most distributions use OpenPGP to sign their updates. Fedora and Debian do for example. You just have to make sure that your automated option validates ...


2

I have no idea who you are and thus why I should or should not trust you. It is my habit, though, of not trusting people "over the Internet"; I use the Internet to exchange information and there is no notion of trusting people for that (there is such a notion of cross-validating information, though). "ISP" means Internet Service Provider. It is perfectly ...


4

It sounds to me as though your router might have it's DNS server setting compromised with malicious servers. The reason you might be getting sent to the malicious IP address when you ping facebook.com is because that lookup is being referenced to either a rogue DNS server that serves bogus requests, or you have a hosts file that's been overwritten. I would ...


1

I think the only wayx to detect the attack would be to run a custom script in the backgorund of your session, which would send all your DNS requests to a trusted secured DNS-Server (using signing or HTTPS) and also to your local DNS. Then it could compare the results and give you an alertbox if the results don't match e.g. if the provided IP-Adresses are not ...


6

I'm afraid we won't have a proper solution until we get everyone to use DNSSEC. However, I predict that unless someone discovers a really critical flaw in dns protocol forcing everyone to implement it, it will take many many years ☹ (just look at IPv6). As a partial solution, you could have the dns resolver set to a trusted dns resolver which also signs ...


-1

I installed Dnssec Trigger which includes Bind on my pc. There is a local key on your machine. I'd like to find a service which includes both DNS protocols since they are not exclusive. From their website. Dnssec trigger enables the end-host (laptop or desktop computer) to use DNSSEC protection for the DNS traffic. DNS translates names of computers into ...


0

Your problem probably has nothing to do with viruses. If you can only access a specific domain, it may be that this one (for whatever reason) is inside your DNS cache but you can't reach any other site because your DNS server is unresponsive. I would start by using a network analysis utility (such as Wireshark) to determine whether DNS queries succeed or ...


1

If the host machine has a damaged hosts file, any traffic going from the guest VM, through the host, will encounter this damaged hosts file before it accesses the internet. EVEN IF the guest is using a USB wifi adapter, it will still have to interact with the hosts host file.


0

VM commands get redirected through the host OS. Some stuff may go direct to the CPU depending on what kind of virtualization support your system has, but that is still only granted at the will of the host OS. If the host OS is compromised, then the virus can potentially impact anything running within it, including a virtual other process. Sandboxing tries ...


0

You might need to change some computer habits if you've been "pirated several times already", but to answer your question, yes it's definitely possible for a virus on your host to have adverse effects on a VM. The VM uses resources allocated to it by the host machine. If your Guest OS has direct access to your host file system for example, it's entirely ...


2

It is not a good idea to have a public DNS record which points to a non-public IP address. This can be used to circumvent same origin policies by exploiting issues on internal systems. For more details see http://www.securityfocus.com/archive/1/486606, where a vulnerability in CUPS on localhost was exploited this way. Probably easier and definitly safer ...


0

Many organizations have a central email server that's the only one to be exposed to the outside and which forwards emails to some satellite node (one per geographical site or per organizational department) which isn't visible to the outside network. Furthermore email can be forwarded from server to server. Since forwarding can be based on the content of the ...


1

SMTP is a very, very old protocol, dating from the early days of the Internet when connections weren't reliable and security wasn't a major issue. Many of the issues with SMTP (open relays, unauthenticated senders, etc.) are the result of trying to provide reliable delivery on an unreliable network where everyone knew everyone else (or at least everyone ...


0

Intermediate email servers aren't generally required, but they allow for scale out, and allow for specialized email services to handle particular requirements such as: AV/AS scanning Content Filtering for information controls 3rd party auditing via BCCing (for SEC registered reps, schools, etc) Specialized routing (P1/P2 routing, sender routing) ...


1

Your browser handles what is sent to the DNS service. It should only send the domain name, not the path or parameters. The DNS service depends on what you have set in your network settings. It might be OpenDNS or Google, but it might be handled by the DHCP server of your network. In that case the DNS server is probably the router. If the router does not ...


1

IIRC, DNS service has nothing to do with URLs, the sole thing it does is resolving a domain name into an IP address, which is used to actually connect to the site. So no, they can't point out the specific URL you're trying to visit. Then, surely one could log the source IP together with the domain name being requested, aggregate the data, and sell it. I see ...


1

The first answer doesn't technically answer the question. Official Method There's only one official method of doing this using the dig command: dig @ns.thenameserver.net example.com axfr AXFR is a method of domain transfer and if the nameservers are configured to allow the command to be executed then it would give you the full NS record for that domain ...



Top 50 recent answers are included