The Domain Name System (DNS) translates Internet domain and host names to IP addresses.

learn more… | top users | synonyms

5
votes
0answers
19 views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
2
votes
1answer
52 views

Can a DNS “route” change cause an SSL certificate error?

What I mean by "route change": As a working example, mysite.example.net is set up as: mysite.example.net. 3600 IN CNAME some-other-site.elsewhere.com. ...
0
votes
1answer
50 views

How do I protect myself when using a public network? [duplicate]

I'm in a hostel with plenty of software engineers. I want to make sure I have some protection. I quickly read about dnscrypt and some VPN solutions. What measures can I take to ensure my data ...
1
vote
1answer
34 views

How are DNS requests sent when using ovenvpn? Are they encrypted?

I use openvpn in thru the gnome network manager. When my computer is connected to the vpn do DNS requests look like they come from the vpn exit ip or from my real ip? Are the DNS requests sent in the ...
-3
votes
2answers
64 views

What could an attacker feasibly do if he/she compromises a DNS server? [closed]

I know one could impersonate sites and steal credentials but that is about it. Are there any other types of other attacks, and do companies actively check DNS servers to protect their clients? Also, ...
1
vote
1answer
82 views

Standard for securing web server to client connections via HTTPS on the local area network

I am trying to set up some kind of secure client to web server connection that takes place entirely on local area networks, but I'm having trouble understanding what the recommended best practice is. ...
3
votes
1answer
34 views

What could you do with a PTR record of “localhost”?

In today's log summary from my SSH server, I found the following interesting entry: Illegal users from: 113.175.205.167 (localhost): 2 times Doing a DNS lookup on 113.175.205.167 does indeed ...
0
votes
1answer
48 views

Would changing my DNS get through i-Boss?

I'm not exactly sure how the web filter iBoss works but it doesn't seem to be installed on all the computers at my school so I was thinking it probably handles connections directly at the DNS level ...
3
votes
2answers
52 views

Why does our network firewall drop netbios-ns packets?

In our local domain environment, we use Sophos UTM to protect our network. When I check the firewall logs, I can see that a huge number of packets dropped by the firewall are netbios-ns (UDP 137) ...
0
votes
1answer
36 views

Is there a point to Dnscrypt when using VPN?

If a computer is already connected to the internet through VPN, is there point in encrypting DNS queries? From DNScrypt: DNSCrypt is a protocol that authenticates communications between a DNS ...
0
votes
1answer
89 views

How does a DNS provider provide SSL?

I use CloudFlare as my DNS provider for my domain, and I learned that they provide SSL. I was confused as to how a DNS provider can provide SSL because my communications between the client and my ...
3
votes
1answer
38 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
3
votes
2answers
76 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
1
vote
2answers
43 views

Strange apple dns answers

Could someone please explain to the results of a reverse DNS lookup I ran? dig -x 17.178.96.59 I was expecting apple.com but it also listed a whole load of PTR's. Many looked like phishing sites like ...
3
votes
1answer
109 views

Google DNS query pointing at ISP instead of Google

I am not sure if this is actually an issue or not or if I am just being too paranoid, but I noticed this upon arriving home to Alaska recently (location is important as you'll see shortly). In short, ...
3
votes
1answer
91 views

Is DNS leak really an issue?

I'm reading about DNS leak and what threat it can pose to VPN users, for instance, this question. But generally, there's tons of similar topics on the internet. But what are people afraid of? I just ...
3
votes
2answers
52 views

Why gethosbyname() is as bad as gets() by design?

I know gethosbyname() has been obsolete for a long time. But I see static analysers report its use as unsafe, and when softwares remove its usage, it tends to be for security reasons. I know there ...
0
votes
0answers
26 views

Detecting Spamming activities of Botnets

Remarks Hello Everyone,thanks for being a nice platform for expressing Everyone's Doubts/Views. Problem Statement I want to detect spamming activity of botnets Background Information about ...
3
votes
2answers
111 views

How do I run proper HTTPS on an Internal Network?

This question has been asked several times, I'll link a few: https://superuser.com/questions/791015/https-over-private-network ...
1
vote
3answers
134 views

What SSL certificate do I need?

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a ...
0
votes
0answers
53 views

Do these DNS requests seem like Conficker/Torpig-like behaviour?

I'm at my wit's end on this one... I have been seeing weird traffic from an IP on a client's local network and I think the host is malicious. Looking at the traffic it is producing, is always ...
3
votes
1answer
43 views

Opt into strict DNSSEC checking - does DNSSEC provide a way for a zone to request strict signature validation?

Is there a way for a domain good.com to promise that it will sign all of its DNS records, and that any unsigned records for any host *.good.com should be rejected? In other words, is there a way for ...
0
votes
1answer
38 views

What are the requirements of becoming a WHOIS Proxy or Privacy service (not a registrar)?

This question was put on hold as off-topic at Webmasters, so I'm hoping it's ok to ask here. I've read up on the (outrageous) costs of becoming, maintaining and operating a registrar, but I cannot ...
1
vote
3answers
106 views

Can a rogue DNS server see my passwords?

Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my ...
2
votes
1answer
58 views

Is DNS caching a security vulnerability?

In FireFox, for example, there are network.dnsCacheExpiration and network.dnsCacheEntries preferences in about:config. Is increasing the length of time and number of cached DNS entries a security ...
0
votes
1answer
23 views

Setting up DNSsec for an exotic TLD

I have a .money domain name and I would like to implement DNSSEC. My registrar is GoDaddy and their DNSSEC management system does not support .money. How can I easily setup DNSSEC for my domain?
3
votes
2answers
142 views

How to confirm that my router is vulnerable to the glibc vulnerability (CVE-2015-7547)?

I have tried PoC from Google (https://github.com/fjserna/CVE-2015-7547) to test my host PC (first execute the server side PoC then execute client side PoC). It was vulnerable. Now I want to check my ...
1
vote
1answer
41 views

Secure DHCP, DNS, Active Directory Server

Are there any common vulnerabilities when creating a DHCP,DNS, and Active Directory server that should be addressed immediately? The operating System is Windows Server 2012 R2 64-bit.
-1
votes
2answers
107 views

How risky is to to use external DNS servers? [closed]

My infrastructure doesn't have an internal DNS server, so I just forward any DNS request to external DNS servers by iptables rules. I wonder how risk that can be, and how easy is it to spoof DNS or ...
0
votes
1answer
55 views

Captive portal DNS tunneling

I recently had a meeting with a security researcher who told me about tunnelling over a captive portal using DNS. I have done some research into this but I was wondering what is the simplest way to ...
8
votes
1answer
130 views

In light of the glibc DNS vulnerability, why aren't Linux distros updating install images?

Doesn't that make the mere act of updating a newly installed Linux instance unsafe, since the initially installed package manager is vulnerable? Am I missing something? For example, the current ...
2
votes
1answer
65 views

Does the glibc getaddrinfo vulnerability affect mobile applications?

Recently Google discovered the "glibc getaddrinfo" vulnerability (CVE-2015-7547) Is this a server side only issue, or can apps be affected by it as well? I'm developing both an iPhone and Android ...
-1
votes
1answer
27 views

TLS and DNSCrypt

DNS traffic (requests and responses) has been encrypted by DNSCrypt. In this case, is hostname (https://www.example.com /destination IP adress) readable in transit by a third party during my TLS ...
0
votes
1answer
368 views

trying to dns spoof using mitmf

I am trying to redirect a page of taulukko.com to google.com for learning purposes but no success. When i enter in the taulukko.com from the spoofed node i receive: The webpage cannot be found my ...
0
votes
1answer
48 views

Plaintext DNS traffic in a WPA2 session?

The question I have is, in WPA2 session between the AP and client are DNS requests sent plain text? Trying to wrap my head around the latest glibc exploit. Thank you Ted
-1
votes
1answer
77 views

Can you be vulnerable to the glibc vulnerability in getaddrinfo if you trust your DNS?

I have read that the vulnerability is triggered by a DNS response. How can you be vulnerable if you trust your DNS servers? May your DNS servers redirect your request to other DNS that may be ...
1
vote
1answer
79 views

UDP DNS & Firewall

This question might be simple but please understand my lack of knowledge. I am seeing a lot of DNS packets dropped by our firewall (sophos SG125) by default rule 60001. There are three Domain ...
0
votes
1answer
169 views

Can the latest glibc DNS vuln be tested on remote servers?

I recently heard of the critical DNS vulnerability in glibc that can lead to arbitrary code execution. I hadn't found much about the cases when the faulty function is called and ways to remotely ...
0
votes
1answer
526 views

GNU C Library getaddrinfo() Flaw

As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow ...
1
vote
2answers
110 views

Why did I get a wrong IP and certificate for www.facebook.com just now? [closed]

I just navigated to www.facebook.com and my browser alerted me that an invalid certificate has been received. I checked the cert in question, and I was surprised to see that the Common Name on it was ...
0
votes
1answer
55 views

What should I set the TTL for my DNS to?

I've heard before that one should set TTL for the domains of recovery emails to as high value as possible. The threat model here is that an attacker uses social engineering tactics to gain access to ...
1
vote
1answer
38 views

Network Scans Find Absent Device

Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a ...
3
votes
0answers
93 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
0
votes
0answers
34 views

How to update a non clientUpdateProhibited domain name?

So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all ...
2
votes
1answer
74 views

DNSCrypt-proxy: This certificate looks valid

I have just installed dnscrypt-proxy and dnsmasq with DNSSEC but I get a strange message in the logfile from dnscrypt-proxy. [INFO] + DNS Security Extensions are supported [INFO] - [dnscrypt.eu-dk] ...
33
votes
4answers
4k views

How can changing your DNS protect your online privacy?

Looking at a Unblock-US Features (a DNS provider) on their website it states the following: Stay out of the radar of prying eyes. With Unblock-us, you’ll have peace of mind knowing that your ...
3
votes
1answer
45 views

How to acquire DNSSEC root trust anchor from IANA?

I want to establish trust in a DNSSEC record. I found, that it can be done $ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee root.key could be obtained with $ dig . DNSKEY @8.8.8.8 | grep ...
2
votes
1answer
63 views

Can I use a domain name instead of an IP for msf persistence?

After getting a shell (meterpreter) on the victim, the first thing to do is to migrate and get the system, and then you would install a persistence to connect back to you. But the problem is the ...
11
votes
3answers
331 views

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
2
votes
0answers
55 views

bind9 resolves all queries to one address - a compromised server?

Since this morning we tried to open some SSL sites and were greeted by browser warnings, that certificate is not for this site. Upon checking the certificate, we determined that it is issued to ...