Hot answers tagged

254 votes
Accepted

Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?

That domain is an encoded form of the string "WORKGROUP". It is using a variant of hex encoding that uses the letters A-P, instead of the numbers 0-9 followed by A-F. $ echo ...
user avatar
  • 846
126 votes
Accepted

Did I just get DNS Hijacked?

Yes, your router's primary DNS entry was pointed to a rogue DNS server to make devices in your network resolve apple.com and other domains to phishing sites instead. The router possibly got ...
user avatar
  • 43.7k
74 votes

Is my Windows 10 machine experiencing DNS poisoning? I keep getting Chinese IP addresses when connecting to a U.S. government domain

Content Delivery Network This is probably part of a Content Delivery Network with a lot of political issues to consider. If you try dig www.whitehouse.gov a, underneath the answer section you'll ...
user avatar
  • 22.5k
69 votes

What makes Let's Encrypt secure?

Same security as other DV certs What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for awesomebank.example, and then using it to MITM customers of ...
user avatar
69 votes
Accepted

More than three domains hosted on the same IP address

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of ...
user avatar
59 votes
Accepted

What stops someone from just redirecting a HTTPS connection to a HTTP version of the site?

The decision on whether to use HTTP or HTTPS is the client's. If the user goes directly to http://example.com, an attacker could simply hijack that connection and perform a man-in-the-middle attack. ...
user avatar
  • 132k
56 votes
Accepted

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...
user avatar
51 votes
Accepted

How can changing your DNS protect your online privacy?

Essentially, it doesn't. DNS servers let your computer look up where websites and other services are based on friendly names, by converting those to IP addresses. Your ISP provides this as a service, ...
user avatar
  • 27.2k
49 votes

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in ...
user avatar
  • 32.6k
49 votes
Accepted

Is it possible for a name server provider to hijack MX records?

Yes, your registrar can hijack not only your MX records, but your entire DNS. Not only that - but they can then proceed to intercept mail sent to your domain, get a valid CA-signed SSL certificate ...
user avatar
  • 19.6k
48 votes

How could a public DNS server return bad results?

How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8? They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
user avatar
41 votes
Accepted

Why is it better to use ports 20 and 53 as source ports when portscanning?

You guessed correctly. According to the Nmap Reference Guide: --source-port <portnumber>; -g <portnumber> (Spoof source port number) One surprisingly common misconfiguration is to trust ...
user avatar
  • 3,552
36 votes
Accepted

How does a website know the DNS server a client uses?

This is a DNS resolution trick that could also be performed using non-http protocols but in this case is performed by using random hostnames and zero-pixel images via http. Look at the source code on ...
user avatar
  • 14.1k
35 votes

Is my Windows 10 machine experiencing DNS poisoning? I keep getting Chinese IP addresses when connecting to a U.S. government domain

Well, I've installed Wireshark and applied a DNS filter to see what was happening. When I do the nslookup from Windows to whitehouse.gov I can see in Wireshark that it is appending (without showing it ...
user avatar
  • 661
35 votes

Why is "fhepfcelehfcepfffacacacacacacabn" a top DNS query from my devices?

Update: This answer by Miles is a better insight, the explanation given by NextDNS support seems wrong. I contacted NextDNS support asking for more details and they said this is Google Chrome testing ...
user avatar
  • 852
32 votes

How do I run proper HTTPS on an Internal Network?

Certificate validation is done to make sure that the peer is the one you expect. Validating a server certificate in the browser is mainly done by checking that the hostname from the URL matches the ...
user avatar
32 votes
Accepted

Why don't browsers check CAA records to help ensure a certificate is valid?

I just found the answer in RFC 6844, DNS Certification Authority Authorization (CAA) Resource Record: A set of CAA records describes only current grants of authority to issue certificates for the ...
user avatar
32 votes

More than three domains hosted on the same IP address

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
user avatar
30 votes
Accepted

How to test for zone transfer?

The syntax for host is: host -t axfr domain.name dns-server For dig: dig axfr @dns-server domain.name Replace dns-server with the authoritative DNS server and domain.name with your target domain ...
user avatar
30 votes

Does DNS allow third parties to register subdomains?

Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain. DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a ...
user avatar
  • 2,693
30 votes

Why is DNS-over-HTTPS such a big security nightmare compared to DNS-over-TLS?

Again, it's all about the threat model! Technologies are just technologies and can be used both for good and for evil. DNS over HTTPS (DoH) intends to solve the privacy concerns there are with ...
user avatar
  • 15.9k
29 votes
Accepted

Does DNS allow third parties to register subdomains?

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...
user avatar
29 votes
Accepted

Is a global DNS record a security risk for phpMyAdmin?

This would qualify as 'Security through Obscurity' and offers little to no protection whatsoever. The /etc/hosts file is NOT DNS; it's the precursor of DNS and anyone can change their own records in ...
user avatar
  • 8,151
27 votes
Accepted

How can I stop someone from displaying my website on his domain?

The answer depends on the web-server you are using. For example, apache allows for the creation of multiple virtual hosts, of which the first described is considered the default one. What I suggest ...
user avatar
  • 13k
21 votes
Accepted

dns reflection attack vs dns amplification attack

Full disclosure, I work for a company that develops DDoS mitigation and web application firewall services DNS amplification is a Distributed Denial of Service (DDoS) attack in which the attacker ...
user avatar
  • 226
21 votes
Accepted

Is my modem compromised?

UPDATE Your device (W8901G) is in all likelihood VULNERABLE, to the very exploit described below, and more, and even more. I think that the steps suggested below may ameliorate your situation, but ...
user avatar
  • 22.5k
21 votes

Did I just get DNS Hijacked?

It's obvious that someone changed DNS entries inside your router, probably using default credentials. You should go with factory reset, update your firmware, change default credentials and disable ...
user avatar
  • 9,975
21 votes

How could a public DNS server return bad results?

unfortunately they are not doing so! They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it. Your confusion stems in part from ...
user avatar
  • 681
21 votes
Accepted

What does my ISP see if I change my DNS server?

So, I think, that when I type certain URL in my browser (for example https://google.com) I send request through ISP to ISP DNS and my provider gets response (ip of google.com) and goes by this IP and ...
user avatar
20 votes
Accepted

How secure is binding to localhost in order to prevent remote connections?

The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1. Under normal circumstances, ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible