Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results?
It would be very simply to detect an attack along the lines of DNSChanger (just alert the user if the DNS server ip has been changed) but suppose a system like DNSChanger had worked by proxying your DNS queries and editing them on the fly.. how could you detect this?
I'm not aware of any tools, and I'm not sure how effective they would be. If you got enough privileges to change the DNS servers of a system, you can probably also disable any anti-malware programs.
If you still want to, you could easily write a script that does the following:
From which you can conclude:
This is, like with almost everything, not entirely safe. Like I said, malware needs a lot of privileges to do this, it's not unthinkable that it spoofs the IP for trusted servers like OpenDNS or Google's public DNS, making them appear to return the same answer as the malware server.
Probably the only way to ensure you are talking to trusted DNS servers, is by using DNSSEC.
Select a site whose IP never changes (Do not select a site that uses Akamai or any other multiple IP hosting, but more likely, a small company site), and simply run a script on the machine, constantly querying that site. If the IP returned changes - then you know you have malware.
You can run TSIG DNS checks (private key shared between host and requester), then run a CRON that listens for error responses and prompts action. It's used for verifying Dynamic DNS updates, but it could easily be used for security if you setup the secret key transfer correctly (eg. rsync over SSH).
This protocol allows for transaction level authentication using
shared secrets and one way hashing. It can be used to authenticate
dynamic updates as coming from an approved client, or to authenticate responses as coming from an approved recursive name server.No provision has been made here for distributing the shared secrets; it is expected that a network administrator will statically configure name servers and clients using some out of band mechanism such as sneaker-net until a secure automated mechanism for key distribution is available.
In regard to stale records and replay attacks:
3.3. Time values used in TSIG calculations
The data digested includes the two timer values in the TSIG header in order to defend against replay attacks. If this were not done, an attacker could replay old messages but update the "Time Signed" and "Fudge" fields to make the message look new.
There's an excellent read on DNS security in O'Reilly DNS and Bind.
