1
00:00:00,480 --> 00:00:01,313
In this lesson,

2
00:00:01,313 --> 00:00:04,590
we'll focus on Domain Name System attacks.

3
00:00:04,590 --> 00:00:07,920
The Domain Name System, also known simply as DNS,

4
00:00:07,920 --> 00:00:09,300
is a fundamental component

5
00:00:09,300 --> 00:00:10,950
of the internet that is responsible

6
00:00:10,950 --> 00:00:13,350
for translating human-friendly domain name

7
00:00:13,350 --> 00:00:16,379
into IP addresses that computers can understand.

8
00:00:16,379 --> 00:00:19,800
However, its critical role also makes it a prime target

9
00:00:19,800 --> 00:00:21,090
for cyber attacks.

10
00:00:21,090 --> 00:00:24,540
So let's explore some of the various types of DNS attacks

11
00:00:24,540 --> 00:00:28,950
including DNS cache poisoning, DNS amplification attacks,

12
00:00:28,950 --> 00:00:31,890
DNS tunneling, domain hijacking,

13
00:00:31,890 --> 00:00:34,260
and DNS zone transfer attacks

14
00:00:34,260 --> 00:00:36,180
and some of the mitigation strategies

15
00:00:36,180 --> 00:00:37,953
for each of these types of attacks.

16
00:00:38,790 --> 00:00:41,730
First, we have DNS cache poisoning.

17
00:00:41,730 --> 00:00:44,820
DNS cache poisoning, also known as DNS spoofing,

18
00:00:44,820 --> 00:00:47,400
involves corrupting the DNS cache data

19
00:00:47,400 --> 00:00:50,520
of a DNS resolver with false information.

20
00:00:50,520 --> 00:00:52,530
This leads the resolver to direct traffic

21
00:00:52,530 --> 00:00:55,830
to an incorrect IP address set up by the attacker,

22
00:00:55,830 --> 00:00:57,660
often to a malicious website.

23
00:00:57,660 --> 00:01:00,240
For example, an attacker could poison the DNS cache

24
00:01:00,240 --> 00:01:02,490
of a popular online banking website

25
00:01:02,490 --> 00:01:05,010
and then cause the bank's users to be redirected

26
00:01:05,010 --> 00:01:07,470
to a fake website where their logging credentials

27
00:01:07,470 --> 00:01:09,960
could be stolen by the attackers.

28
00:01:09,960 --> 00:01:14,130
To prevent DNS cache poisoning, you should utilize DNSSEC

29
00:01:14,130 --> 00:01:17,370
or the Domain Name System security extensions

30
00:01:17,370 --> 00:01:18,780
to add digital signatures

31
00:01:18,780 --> 00:01:20,760
to your organization's DNS data to ensure

32
00:01:20,760 --> 00:01:23,070
that its authenticity and integrity

33
00:01:23,070 --> 00:01:25,710
are confirmed during any DNS lookup.

34
00:01:25,710 --> 00:01:28,710
Also, you should implement secure network configurations

35
00:01:28,710 --> 00:01:30,840
and firewalls to protect your DNS servers

36
00:01:30,840 --> 00:01:33,930
from unauthorized access to prevent DNS cache poisoning

37
00:01:33,930 --> 00:01:36,300
from occurring on your systems.

38
00:01:36,300 --> 00:01:39,570
Second, we have DNS amplification attack.

39
00:01:39,570 --> 00:01:41,520
In a DNS amplification attack

40
00:01:41,520 --> 00:01:44,310
the attacker exploits the DNS resolution process to

41
00:01:44,310 --> 00:01:47,910
overwhelm a target system with DNS response traffic.

42
00:01:47,910 --> 00:01:49,620
The attacker sends a DNS query

43
00:01:49,620 --> 00:01:52,110
with a spoofed IP address of their victim

44
00:01:52,110 --> 00:01:55,380
to an open DNS server, which will then send back

45
00:01:55,380 --> 00:01:58,140
a large response to the victim's IP address.

46
00:01:58,140 --> 00:02:01,110
For example, if an attacker could send a small query

47
00:02:01,110 --> 00:02:04,140
to an open DNS server to request a large amount of data

48
00:02:04,140 --> 00:02:06,990
like the entire list of hosts in the domain,

49
00:02:06,990 --> 00:02:09,090
this will be sent to the victim's IP address

50
00:02:09,090 --> 00:02:12,030
which in turn causes a flood of unwanted traffic

51
00:02:12,030 --> 00:02:13,050
which can appear to look

52
00:02:13,050 --> 00:02:16,080
like a DOS attack against a victim's system.

53
00:02:16,080 --> 00:02:18,750
One way to mitigate DNS amplification attacks is to

54
00:02:18,750 --> 00:02:22,860
limit the size of DNS responses or rate limit any DNS

55
00:02:22,860 --> 00:02:24,690
response traffic to mitigate the impact

56
00:02:24,690 --> 00:02:26,490
of this type of attack.

57
00:02:26,490 --> 00:02:28,530
Third, we have DNS tunneling.

58
00:02:28,530 --> 00:02:31,620
DNS tunneling involves using the DNS protocol to

59
00:02:31,620 --> 00:02:35,910
encapsulate non-DNS traffic, such as HTTP or SSH

60
00:02:35,910 --> 00:02:39,270
over port 53 to attempt to bypass the organization's

61
00:02:39,270 --> 00:02:42,330
firewall rules in order to conduct command and control

62
00:02:42,330 --> 00:02:44,430
or data exfiltration.

63
00:02:44,430 --> 00:02:47,370
DNS tunneling is actually a legitimate technique

64
00:02:47,370 --> 00:02:49,230
but it's often exploited by attackers

65
00:02:49,230 --> 00:02:51,330
for their own malicious purposes.

66
00:02:51,330 --> 00:02:54,330
For example, an attacker could use DNS tunneling

67
00:02:54,330 --> 00:02:56,040
to bypass a company's firewall

68
00:02:56,040 --> 00:02:59,100
and to exfiltrate sensitive organizational data

69
00:02:59,100 --> 00:03:01,020
Since DNS requests are usually allowed

70
00:03:01,020 --> 00:03:03,630
to pass through a firewall without inspection,

71
00:03:03,630 --> 00:03:05,310
DNS tunneling is quite effective

72
00:03:05,310 --> 00:03:07,980
for sneaking data out of a given network.

73
00:03:07,980 --> 00:03:11,040
For this reason, it's important that you regularly monitor

74
00:03:11,040 --> 00:03:14,190
and analyze your DNS logs for any signs of unusual patterns

75
00:03:14,190 --> 00:03:17,940
or behaviors that could indicate DNS tunneling is occurring.

76
00:03:17,940 --> 00:03:20,640
Fourth, we have domain hijacking.

77
00:03:20,640 --> 00:03:23,490
Domain hijacking, also known as domain theft,

78
00:03:23,490 --> 00:03:26,490
involves the changing of the registration of a domain name

79
00:03:26,490 --> 00:03:29,970
without the permission of the original domain's registrant.

80
00:03:29,970 --> 00:03:33,060
Domain hijacking can lead to loss of control over a website

81
00:03:33,060 --> 00:03:35,970
and potential redirection to a malicious website

82
00:03:35,970 --> 00:03:38,700
and place over the organization's real website.

83
00:03:38,700 --> 00:03:41,910
For example if an attacker could hijack a popular e-commerce

84
00:03:41,910 --> 00:03:45,660
website domain like amazon.com, they can redirect all

85
00:03:45,660 --> 00:03:48,000
of Amazon's traffic to a fake website where

86
00:03:48,000 --> 00:03:50,460
a customer's payment information could be stolen.

87
00:03:50,460 --> 00:03:53,520
Again, conducting regular updates and ensuring

88
00:03:53,520 --> 00:03:55,830
your registration account information is secure

89
00:03:55,830 --> 00:03:58,740
is the best defense against domain hijacking.

90
00:03:58,740 --> 00:04:01,080
Additionally, you should use domain registry

91
00:04:01,080 --> 00:04:03,990
lock services to prevent any unauthorized changes

92
00:04:03,990 --> 00:04:06,900
to your domain registrations to prevent domain hijacking

93
00:04:06,900 --> 00:04:08,580
from occurring in the first place.

94
00:04:08,580 --> 00:04:12,420
Fifth, and finally, we have DNS zone transfer attacks.

95
00:04:12,420 --> 00:04:14,460
In a DNS zone transfer attack

96
00:04:14,460 --> 00:04:16,079
the attacker tries to get a copy

97
00:04:16,079 --> 00:04:18,990
of the entire DNS zone data, which includes all

98
00:04:18,990 --> 00:04:21,420
of the DNS records for domain by pretending to

99
00:04:21,420 --> 00:04:24,090
be an authorized system making that request.

100
00:04:24,090 --> 00:04:27,120
This type of an attack can expose sensitive information

101
00:04:27,120 --> 00:04:29,610
about the network's infrastructure of the domain

102
00:04:29,610 --> 00:04:31,380
and could be used as reconnaissance

103
00:04:31,380 --> 00:04:34,710
for planning future attacks against a given organization.

104
00:04:34,710 --> 00:04:38,940
So remember, DNS attacks exploits the Domain Name System's

105
00:04:38,940 --> 00:04:41,820
vulnerabilities to disrupt service, steal information,

106
00:04:41,820 --> 00:04:44,490
or redirect a website's traffic.

107
00:04:44,490 --> 00:04:47,370
DNS cache poisoning involves corrupting a DNS

108
00:04:47,370 --> 00:04:48,960
resolvers cache.

109
00:04:48,960 --> 00:04:52,050
DNS amplification attacks uses the DNS resolution

110
00:04:52,050 --> 00:04:55,260
process to flood a target with traffic to create a denial

111
00:04:55,260 --> 00:04:57,300
of service type of condition.

112
00:04:57,300 --> 00:05:00,900
DNS tunneling can be used to bypass firewall rules

113
00:05:00,900 --> 00:05:02,913
and to conduct data exfiltration.

114
00:05:03,870 --> 00:05:06,750
Domain hijacking involves unauthorized changes

115
00:05:06,750 --> 00:05:08,730
to a domain's registration.

116
00:05:08,730 --> 00:05:12,120
And the DNS zone transfer attack aims to get a copy

117
00:05:12,120 --> 00:05:14,490
of a domain's DNS zone data.

118
00:05:14,490 --> 00:05:16,470
By understanding how these attacks are performing

119
00:05:16,470 --> 00:05:18,450
you can easily put mechanisms in place

120
00:05:18,450 --> 00:05:20,000
to prevent them from happening.