6

I was performing an DNS brute-force on our company's domain and found entries like "html" "ww" and "wwww" resolving to IPs outside of our registered block.

This sparked a debate about just how dangerous this would really be to let those entries exist. It would seem that someone could redirect users of our site to a credential harvesting site for instance using a look-a-like website and URL, but those I was trying to convince did not seem to agree.

What is the real danger here?

Improve this question
2
  • 1
    I know at least one of those entries should really concern you. I would create entries and push an update to your register. Have you confirmed this isn't simply a case of these entries being owned by the domain register for instance?
    – Ramhound
    Dec 7, 2011 at 21:04
  • yes - The owner of the domain name in question is the key question. The hostname (the "www" part of www.domain.com) is owned by the zone owner (the responsible party for the domain.com bit); they need to be trustworthy.
    – TristanK
    Dec 7, 2011 at 21:15

3 Answers 3

Reset to default
6

This is very dangerous. If someone has control over your DNS they can, for example, steal all your email or your web traffic.

  • First, do you operate your own DNS servers, or are they hosted (e.g. at a hosting provider or at your registrar)?
    • Hosted:
      • Check the control panel for these extra entries. They may be prepopulated to point to the host's servers.
      • If your hosting provider supports it, export your zone file and look for these entries. (For the odd case where they don't show up in the control panel, but are still in the zone.)
      • After you follow the steps below to ensure that the entries are coming from your host's DNS server, call your hosting provider and ask about these entries.
      • After you figure out where/why the entries are there, you can decide to leave them, remove them, and/or switch hosting providers.
    • Self-operated:
      • Manually inspect your zone file to see if the entries are there.
  • Do a reverse lookup on the IPs that those bogus entries are resolving to:
    • host 10.1.2.3
    • Does the name you get back make sense -- e.g. is it your hosting provider or some other related party?
    • If the lookup doesn't give you a name, look up the owner of the netblock to see if that gives you any clues:
    • whois 10.1.2.3
  • Check if the entries are coming from your DNS server by looking up one of the bogus entries:
    • dig ww.mycompany.dom @ns1.mycompany.dom
  • Check if the entries are coming from your secondary DNS (and/or tertiary, etc):
    • dig ww.mycompany.dom @ns2.mycompany.dom
  • If the entries aren't in one of your DNS servers, try to figure out where they are coming from. This command will give you a trace of the lookup starting at the root servers and going down to your domain:
    • dig +trace ww.mycompany.dom
  • If the trace doesn't show the entry, then it's possible you are using a DNS service (e.g. opendns) that "steals" bogus hostnames to redirect them to their servers. (Certain DNS servers will always return an IP for any lookup, even if there is no host registered to that address; the IP returned points to their server. For example, if I do dig bogusboguszzzzx.net @208.67.222.222 I get back 67.215.65.132, which reverses to hit-nxdomain.opendns.com.)
    • Don't use this kind of service for testing! (I think it's a bad idea in general because it breaks DNS, but YMMV...)
Improve this answer
1
  • 1
    The "dig +trace" command was new to me! That plus some of your other suggestions helped me zone in on the real issues going on and I was able to show others, too. Thanks for your time to address this.
    – schroeder ♦
    Dec 8, 2011 at 15:57
2

Can you tell who created the entries? Do you have access to edit your zone file? You might try checking those entries on the outside web and also internally. It could be an issue with your internal DNS server. If someone has access to create a ww or wwww then there is no reason that they can't redirect the real www address.

Improve this answer
1
  • 1
    The check was done externally. Internally, the requests are handled by our internal DNS and the extraneous entries don't exist.
    – schroeder ♦
    Dec 7, 2011 at 23:24
2

Some ISPs have provide a service that redirects your browser to one of their search pages when you type a host name that doesn't exist in your browser. This relies on catching all DNS requests that wouldn't normally resolve and send one of their own IP addresses instead.

Try typing the incorrect name in a web browser (from the network where you've found these issues) and see what you get. It may just be a page from the ISP; you may also be able to find some explanation in the corner of the page, and be offered to opt out.

There is a link for a specific ISP (from Wikipedia), which describes their policy: http://www.optimum.net/Article/DNS.

It's not a great practice, especially when you can't trust the page you're redirected to, but if this problem is indeed specific to a given ISP, it's not a problem with your DNS server. In this case, there's little you can do apart from trying to opt out from this "feature". This is more a problem for your users than for your company, but there's little you can do if they can't trust their ISP at least to resolve DNS correctly (some will also prevent you from using external DNS servers).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.