In this lesson,
we'll focus on Domain Name System attacks.
The Domain Name System, also known simply as DNS,
is a fundamental component
of the internet that is responsible
for translating human-friendly domain name
into IP addresses that computers can understand.
However, its critical role also makes it a prime target
for cyber attacks.
So let's explore some of the various types of DNS attacks
including DNS cache poisoning, DNS amplification attacks,
DNS tunneling, domain hijacking,
and DNS zone transfer attacks
and some of the mitigation strategies
for each of these types of attacks.
First, we have DNS cache poisoning.
DNS cache poisoning, also known as DNS spoofing,
involves corrupting the DNS cache data
of a DNS resolver with false information.
This leads the resolver to direct traffic
to an incorrect IP address set up by the attacker,
often to a malicious website.
For example, an attacker could poison the DNS cache
of a popular online banking website
and then cause the bank's users to be redirected
to a fake website where their logging credentials
could be stolen by the attackers.
To prevent DNS cache poisoning, you should utilize DNSSEC
or the Domain Name System security extensions
to add digital signatures
to your organization's DNS data to ensure
that its authenticity and integrity
are confirmed during any DNS lookup.
Also, you should implement secure network configurations
and firewalls to protect your DNS servers
from unauthorized access to prevent DNS cache poisoning
from occurring on your systems.
Second, we have DNS amplification attack.
In a DNS amplification attack
the attacker exploits the DNS resolution process to
overwhelm a target system with DNS response traffic.
The attacker sends a DNS query
with a spoofed IP address of their victim
to an open DNS server, which will then send back
a large response to the victim's IP address.
For example, if an attacker could send a small query
to an open DNS server to request a large amount of data
like the entire list of hosts in the domain,
this will be sent to the victim's IP address
which in turn causes a flood of unwanted traffic
which can appear to look
like a DOS attack against a victim's system.
One way to mitigate DNS amplification attacks is to
limit the size of DNS responses or rate limit any DNS
response traffic to mitigate the impact
of this type of attack.
Third, we have DNS tunneling.
DNS tunneling involves using the DNS protocol to
encapsulate non-DNS traffic, such as HTTP or SSH
over port 53 to attempt to bypass the organization's
firewall rules in order to conduct command and control
or data exfiltration.
DNS tunneling is actually a legitimate technique
but it's often exploited by attackers
for their own malicious purposes.
For example, an attacker could use DNS tunneling
to bypass a company's firewall
and to exfiltrate sensitive organizational data
Since DNS requests are usually allowed
to pass through a firewall without inspection,
DNS tunneling is quite effective
for sneaking data out of a given network.
For this reason, it's important that you regularly monitor
and analyze your DNS logs for any signs of unusual patterns
or behaviors that could indicate DNS tunneling is occurring.
Fourth, we have domain hijacking.
Domain hijacking, also known as domain theft,
involves the changing of the registration of a domain name
without the permission of the original domain's registrant.
Domain hijacking can lead to loss of control over a website
and potential redirection to a malicious website
and place over the organization's real website.
For example if an attacker could hijack a popular e-commerce
website domain like amazon.com, they can redirect all
of Amazon's traffic to a fake website where
a customer's payment information could be stolen.
Again, conducting regular updates and ensuring
your registration account information is secure
is the best defense against domain hijacking.
Additionally, you should use domain registry
lock services to prevent any unauthorized changes
to your domain registrations to prevent domain hijacking
from occurring in the first place.
Fifth, and finally, we have DNS zone transfer attacks.
In a DNS zone transfer attack
the attacker tries to get a copy
of the entire DNS zone data, which includes all
of the DNS records for domain by pretending to
be an authorized system making that request.
This type of an attack can expose sensitive information
about the network's infrastructure of the domain
and could be used as reconnaissance
for planning future attacks against a given organization.
So remember, DNS attacks exploits the Domain Name System's
vulnerabilities to disrupt service, steal information,
or redirect a website's traffic.
DNS cache poisoning involves corrupting a DNS
resolvers cache.
DNS amplification attacks uses the DNS resolution
process to flood a target with traffic to create a denial
of service type of condition.
DNS tunneling can be used to bypass firewall rules
and to conduct data exfiltration.
Domain hijacking involves unauthorized changes
to a domain's registration.
And the DNS zone transfer attack aims to get a copy
of a domain's DNS zone data.
By understanding how these attacks are performing
you can easily put mechanisms in place
to prevent them from happening.