In this lesson, we're going to focus
on domain name system attacks.
The domain name system, simply known as DNS,
is a fundamental component of the internet
that's responsible for translating
human-friendly domain names into IP addresses
that computers can understand.
However, this critical role
also makes it a prime target for cyber attacks.
So let's explore some of the various types of DNS attacks,
including DNS cache poisoning, DNS amplification attacks,
DNS tunneling, domain hijacking,
and DNS zone transfer attacks,
and some of the mitigation strategies
for each of these types.
First, we have DNS cache poisoning.
DNS cache poisoning, also known as DNS spoofing,
involves corrupting the DNS cache data
of a DNS resolver with false information.
This leads a resolver to direct traffic
to an incorrect IP address that was set up by the attacker,
often which will be a malicious website.
For example, an attacker could poison the DNS cache
on a popular online banking website,
and then cause the bank's users to be redirected
to a fake site where their logging credentials
could be stolen by the attackers.
To prevent DNS cache poisoning, you should utilize DNSSEC
or the Domain Name System Security Extensions
to add a digital signature to your organization's DNS data
to ensure its authenticity
and integrity are confirmed during any DNS lookups.
Also, you should implement secure network configurations
and firewalls to protect your DNS from unauthorized access
to prevent DNS cache poisoning
from occurring on your systems.
Second, we have DNS amplification attacks.
In a DNS amplification attack,
the attacker exploits the DNS resolution process
to overwhelm a target system with DNS response traffic.
The attacker sends a DNS query with a spoofed IP address
of their victim to an open DNS server,
which will then send back a large response
to the victim's IP address.
For example, if an attacker could send a small query
to an open DNS server and request a large amount of data
like the entire list of hosts in a domain,
this would then be sent to the victim's IP address,
which in turn causes a flood of unwanted traffic,
which can appear to look like a denial of service attack
against that victimized system.
One way to mitigate DNS amplification attacks
is to set the size of the DNS responses
or to rate limit any DNS response traffic
to mitigate the impact of this kind of an attack.
Third, we have DNS tunneling.
Now, DNS tunneling involves using the DNS protocol
to encapsulate non-DNS traffic,
such as HTTP or SSH over port 53
and attempt to bypass the organization's firewall rules
so they can conduct command and control
or data exfiltration.
DNS tunneling is actually a legitimate technique,
but it often is exploited by attackers
for their own malicious purposes.
For example, an attacker could use DNS tunneling
to bypass a company's firewall
and to exfiltrate sensitive organizational data.
Since DNS requests are usually allowed
to pass through a firewall without inspection,
DNS tunneling is quite effective
for sneaking data out of a given network.
For this reason, it's important that you regularly monitor
and analyze your DNS logs for any signs
of unusual patterns of behavior
that could indicate DNS tunneling has been occurring.
Fourth, we have domain hijacking.
Now, domain hijacking, also known as a domain theft,
involves changing the registration of a domain name
without the permission of the original domains registrant.
Domain hijacking can lead to a loss of control
over a website and potential redirection
to a malicious website in place
of the organization's real website.
For example, if an attacker
could hijack a popular e-commerce website's domain
like amazon.com, they could redirect all of Amazon traffic
to a fake site where a customer's payment information
could be stolen.
The best defense against domain hijacking
is really to conduct regular updates
and ensuring your account registration information
is secure.
Additionally, you should use
the domain registry lock services that are available to you
to prevent any unauthorized changes
to your domain registrations
in order to prevent domain hijacking
from occurring in the first place.
Fifth and finally, we have DNS zone transfer attacks.
In a DNS zone transfer attack,
the attacker's going to try to get a copy
of the entire DNS zone data,
which includes all the DNS records for a domain
by pretending to be an authorized system
who's making that request.
This type of an attack can expose sensitive information
about the network infrastructure of a domain,
and it could be used as part of reconnaissance
for a future attack that's being planned
against a given organization.
So remember, DNS attacks are designed
to exploit the domain name services vulnerabilities
in order to disrupt service, steal information
or redirect a website's traffic.
DNS cache poisoning involves corrupting
a DNS resolvers cache and DNS amplification attacks
are going to use DNS resolution processes
to flood a target with traffic
to create a denial of service type of condition.
DNS tunneling is going to be used to bypass firewall rules
and to conduct data exfiltration.
Domain hijacking will involve unauthorized changes
to the domain's registration.
And a DNS zone transfer attack tries to get a copy
of the domain's DNS zone data.
By understanding how these attacks are performed,
you're going to be better able to put mechanisms in place
to prevent and mitigate them
from happening on your networks.