Lecture 12: DNS Security Intro

Question 1

Who controls what the authoritative name servers says?

Answer 1

The domain owner

Question 2

What is the most common exploit involving DNS?

Answer 2

Domain hijacking

Question 3

What are the forms domain hijacking can take?

Answer 3

The complete seizure of a domain name and transferal of ownership to the malicious party

Malicious redirection of a domain name using the DNS system to point to an incorrect server address

Question 4

What is the most common way a domain is hijacked?

Answer 4

Theft of domains

Attacker finds a way to access your register account, then using that info to gain access to your account and initiate transfers of your domain names to themselves or a third party

Question 5

Why would attackers want to steal a domain name?

Answer 5

• Can point domain towards a server that offers a lookalike application to steal client information
• Use domain name and its existing user base to spread a political message
• Try to resell domain on the open market

Question 6

What is some of the built in protection to make domain theft harder?

Answer 6

• ICANN requires a domain can’t be transferred between registrars within 60 days of the last registration change
• Many registrars offer some form of locking, placing a time lock on when a transfer can occur

Question 7

What is request hijacking?

Answer 7

The attacker listens for DNS requests on the local network and responds to them with incorrect or malicious DNS responses

Question 8

What type of hijacking does not require that the attacker have control of your register accounts or underlying domain name

Answer 8

Request hijacking

Question 9

What are some of the forms of DNS request hijacking?

Answer 9

Cache poisoning
Subversion of DNS resolvers

Question 10

How does DNS interception work?

Answer 10

• Hijacker listens for appropriate DNS requests
• Hijackers responds with an incorrect response before the actual DNS resolver returns its response
• Attack can then direct the user to an incorrect server IP for spoofing or blocking access

Question 11

Why does DNS interception work?

Answer 11

• UDP DNS has no authentication procedure, client has no way of telling it has received a bogus response
• Attacker can spoof the sending IP address to make it look like it came from the correct resolver IP

Question 12

What are the limitations of DNS interception?

Answer 12

• Attack must beat the DNS resolver in returning a response
• Attacker must be able to scan client traffic
• These kind of attacks will only hit a minimal number of users