In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post, the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases?
The following list are the attack types from the first post, where DNSSEC can protect the users:
- DNS cache poisoning the DNS server, "Da Old way"
- DNS cache poisoning, "Da Kaminsky way"
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
The following list are the attack types from the first post, where DNSSEC cannot protect the users:
- Rogue DNS server set via malware
- Having access to the DNS admin panel and rewriting the IP
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
If you are a reader who thinks while reading, you might say "What the hell? Am I protected or not???". The problem is that it depends… In the case where the attacker is between you and your DNS server, the attacker can impersonate the DNS server, downgrade it to a non DNSSEC aware one, and send responses without DNSSEC information.
Now, how can I protect against all of these attacks? Answer is "simple":
- Configure your own DNSSEC aware server on your localhost, and use that as a resolver. This is pretty easy, even I was able to do it using tutorials.
- Don't let malware run on your system! ;-)
- Use at least two-factor authentication for admin access of your DNS admin panel.
- Use a registry lock (details in part 1).
- Use a DNSSEC aware OS.
- Use DNSSEC protected websites.
- There is a need for an API or something, where the client can enforce DNSSEC protected answers. In case the answer is not protected with DNSSEC, the connection can not be established.
Now some random facts, thoughts, solutions around DNSSEC:
- Did you know .SE signed its zone with DNSSEC in September 2005, as the first TLD in the world?
- Did you know DNSSEC was first deployed at the root level on July 15, 2010?
- Did you know .NL become the first TLD to pass 1 million DNSSEC-signed domain names?
- Did you know that Hungary is in the testing phase of DNSSEC (watch out, it is Hungarian)?
- Did you know that you can also use and test that cool DNSSEC validator?
- Did you know that there are alternative solutions like DNSCrypt?
- Did you know that in the future you might be able to enforce HSTS via DNSSEC?
- Did you know that in the future you might be able to use certificate pinning via DNSSEC?
Note from David:
Huh, I have just accidentally deleted this whole post from Z, but then I got it back from my browsing cache. Big up to Nir Sofer for his ChromeCacheView tool! Saved my ass from kickin'! :D
Related news
- Ethical Hacker Tools
- Blackhat Hacker Tools
- Hacking Tools For Beginners
- Hacking Tools For Windows
- Underground Hacker Sites
- Hacker Tools Github
- Hack Tools Download
- Free Pentest Tools For Windows
- Pentest Tools For Android
- Tools 4 Hack
- Android Hack Tools Github
- Pentest Tools Android
- Hacking Tools For Mac
- Hacking Tools For Windows 7
- Game Hacking
- Hacker Search Tools
- Github Hacking Tools
- Hack App
- Wifi Hacker Tools For Windows
- Pentest Recon Tools
- Nsa Hack Tools Download
- Hacker
- Pentest Recon Tools
- Hacking Tools Usb
- Hacking Tools Pc
- Hack Rom Tools
- Hacking Tools For Pc
- Hack Tool Apk No Root
- Hack Apps
- Hacking Tools Pc
- Hacker Techniques Tools And Incident Handling
- Kik Hack Tools
- Hacker Tools For Ios
- Hack Tools For Windows
- Pentest Tools For Mac
- Pentest Tools Framework
- Hacker Tool Kit
- Hacker Tools List
- Hacker Hardware Tools
- Hacking Tools For Games
- Hack Tools For Mac
- Hacking Tools Name
- Hacking Tools Name
- Hacking Tools For Games
- Underground Hacker Sites
- Hacking Tools Download
- Hacking Tools Pc
- Pentest Tools Online
- Beginner Hacker Tools
- Hacking Tools
- Hacker Tools Mac
- How To Hack
- Best Hacking Tools 2019
- Tools Used For Hacking
- Beginner Hacker Tools
- Hack Tools
- Hack Tools For Ubuntu
- Hacks And Tools
- Hak5 Tools
- Hacking Apps
- Hack Rom Tools
- Pentest Box Tools Download
- Hacker Tools For Ios
- Hacker Tools For Windows
- Hack Tools Online
- Hack Tools
- Hacking Tools 2020
- How To Make Hacking Tools
- Pentest Tools Subdomain
- Hacker Hardware Tools
- Pentest Tools Framework
- Tools 4 Hack
- Hacking Tools For Kali Linux
- Hack Tools 2019
- Hack Tools Online
- Hack Tools
- Hacking Tools For Mac
- Bluetooth Hacking Tools Kali
- Hack Tools 2019
- Hacker Tools 2019
- Hacker Tools 2020
- Top Pentest Tools
- Blackhat Hacker Tools
- Pentest Tools
- How To Install Pentest Tools In Ubuntu
- Hacking Tools
- Pentest Tools For Windows
- Hacking Tools Name
- Pentest Tools Review
- Usb Pentest Tools
- Hack And Tools
- Pentest Tools For Ubuntu
- Tools For Hacker
- Game Hacking
- Pentest Tools Framework
- Pentest Tools Nmap
- Hacking Tools Windows
- Pentest Tools Review
- Beginner Hacker Tools
- Hacking Tools
- Usb Pentest Tools
- Hacking Tools Free Download
- Hack Tools
- Hack App
- Hacker Tools Linux
- Hacking App
- Hacker Tools Software
- World No 1 Hacker Software
- Pentest Tools Alternative
- Nsa Hack Tools
- Hacker Tools Apk
- Hacker Tools For Ios
- Hacking Tools Download
- Hacker
- Hacking Tools And Software
- Pentest Tools Website
- What Are Hacking Tools
- Pentest Tools Android
- Hackers Toolbox
- Pentest Tools Open Source
- Hack Tools
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Kali Linux
- Beginner Hacker Tools
- Hacking Tools For Windows Free Download
- Hacker Tool Kit
- Hack Tools For Mac
- Hack Rom Tools
- Physical Pentest Tools
- Beginner Hacker Tools
- Kik Hack Tools
- Hacking Tools For Windows 7
- Termux Hacking Tools 2019
- Growth Hacker Tools
- Hacker Search Tools
- Pentest Tools Apk
- Hacker Tools Online
- Hacker Tools 2019
- Pentest Recon Tools
- Hack Tools 2019
- Hack And Tools
- Kik Hack Tools
- Hack Tools Online
- Hack Rom Tools
- Usb Pentest Tools
- Hackrf Tools
- Beginner Hacker Tools
- Hacker Tools Linux
- Hacking Tools For Beginners
- Pentest Tools Subdomain
- Hacker Tools 2019
- New Hack Tools
- Underground Hacker Sites
- Pentest Tools Android
- Install Pentest Tools Ubuntu
- Pentest Tools Download
- Nsa Hack Tools Download
- Hacker Tools 2019
- Pentest Tools Bluekeep
- Hacker Tools For Windows
- Blackhat Hacker Tools
- Hack Rom Tools
No comments:
Post a Comment