In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post, the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases?
The following list are the attack types from the first post, where DNSSEC can protect the users:
- DNS cache poisoning the DNS server, "Da Old way"
- DNS cache poisoning, "Da Kaminsky way"
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
The following list are the attack types from the first post, where DNSSEC cannot protect the users:
- Rogue DNS server set via malware
- Having access to the DNS admin panel and rewriting the IP
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
If you are a reader who thinks while reading, you might say "What the hell? Am I protected or not???". The problem is that it depends… In the case where the attacker is between you and your DNS server, the attacker can impersonate the DNS server, downgrade it to a non DNSSEC aware one, and send responses without DNSSEC information.
Now, how can I protect against all of these attacks? Answer is "simple":
- Configure your own DNSSEC aware server on your localhost, and use that as a resolver. This is pretty easy, even I was able to do it using tutorials.
- Don't let malware run on your system! ;-)
- Use at least two-factor authentication for admin access of your DNS admin panel.
- Use a registry lock (details in part 1).
- Use a DNSSEC aware OS.
- Use DNSSEC protected websites.
- There is a need for an API or something, where the client can enforce DNSSEC protected answers. In case the answer is not protected with DNSSEC, the connection can not be established.
Now some random facts, thoughts, solutions around DNSSEC:
- Did you know .SE signed its zone with DNSSEC in September 2005, as the first TLD in the world?
- Did you know DNSSEC was first deployed at the root level on July 15, 2010?
- Did you know .NL become the first TLD to pass 1 million DNSSEC-signed domain names?
- Did you know that Hungary is in the testing phase of DNSSEC (watch out, it is Hungarian)?
- Did you know that you can also use and test that cool DNSSEC validator?
- Did you know that there are alternative solutions like DNSCrypt?
- Did you know that in the future you might be able to enforce HSTS via DNSSEC?
- Did you know that in the future you might be able to use certificate pinning via DNSSEC?
Note from David:
Huh, I have just accidentally deleted this whole post from Z, but then I got it back from my browsing cache. Big up to Nir Sofer for his ChromeCacheView tool! Saved my ass from kickin'! :D
Related news
- Android Hack Tools Github
- Growth Hacker Tools
- Pentest Tools Bluekeep
- Hacking Tools For Windows 7
- Hacker Tools For Windows
- Hacker Tool Kit
- Hacking Tools Windows
- Hacking Tools Download
- Computer Hacker
- Hacking Tools
- Hack Tool Apk
- Pentest Tools Website Vulnerability
- Wifi Hacker Tools For Windows
- Physical Pentest Tools
- Hack And Tools
- Github Hacking Tools
- Computer Hacker
- Best Hacking Tools 2020
- Hak5 Tools
- Hack And Tools
- Hacking Tools Hardware
- Pentest Tools
- Blackhat Hacker Tools
- Hacker Tools Apk Download
- Hacker Tools Mac
- Tools Used For Hacking
- What Is Hacking Tools
- Hack Apps
- Android Hack Tools Github
- Pentest Tools Port Scanner
- Hacking Tools Mac
- Hacker Tools
- Hack Tools Pc
- Hack Tools Online
- Hacker Tools Linux
- Hack Tools For Mac
- Hacking Tools Online
- Hacking Tools Hardware
- Pentest Tools Alternative
- Hacker Tools For Ios
- Install Pentest Tools Ubuntu
- Growth Hacker Tools
- Growth Hacker Tools
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Download
- Underground Hacker Sites
- Hacker Tools For Ios
- Hack Tools 2019
- Hack Tools For Mac
- Hack Tools For Windows
- Hacking Tools For Games
- Computer Hacker
- Pentest Tools Android
- Hack Tools
- How To Install Pentest Tools In Ubuntu
- Pentest Automation Tools
- Pentest Tools Url Fuzzer
- Pentest Tools For Mac
- Pentest Tools List
- Hacking Apps
- Pentest Tools For Mac
- Pentest Tools Open Source
- Pentest Tools Website
- Pentest Tools Find Subdomains
- How To Install Pentest Tools In Ubuntu
- Hacker Tools 2020
- Pentest Tools Find Subdomains
- Hacker Security Tools
- Hacker Tools Apk
- World No 1 Hacker Software
- Hacking Tools For Pc
- Hacking Tools Software
- Hack Tools Pc
- Pentest Tools Apk
- Wifi Hacker Tools For Windows
- Hack Tools For Mac
- Hacking Tools For Windows 7
- Hacker Tools Free Download
- Tools 4 Hack
- Pentest Tools For Android
- Nsa Hack Tools
- Pentest Automation Tools
- Hack Tools
- Termux Hacking Tools 2019
- Ethical Hacker Tools
- Pentest Tools Port Scanner
- Github Hacking Tools
- Physical Pentest Tools
- Pentest Automation Tools
- Underground Hacker Sites
- New Hack Tools
- Hack Apps
- Hacking Tools Usb
- Nsa Hacker Tools
- Tools Used For Hacking
- Pentest Tools Open Source
- Pentest Tools Alternative
- Hacking Tools For Kali Linux
- Game Hacking
- Blackhat Hacker Tools
- Tools Used For Hacking
- Hacking Tools Kit
- Hackers Toolbox
- Hack Tools Online
- Hacker Tools Apk Download
- Hacker Tools Software
- Hack Tools Mac
- Hack Tools 2019
- Pentest Tools Tcp Port Scanner
- Hacking Tools Usb
- Hacker
- Hack Tools For Ubuntu
- Top Pentest Tools
- Hacking Tools Windows
- Hack Tools
- What Are Hacking Tools
- Pentest Tools Nmap
- Hacker Search Tools
- Tools For Hacker
- Nsa Hack Tools Download
- Pentest Automation Tools
- Nsa Hack Tools
- Hacker Techniques Tools And Incident Handling
- Pentest Tools Apk
- Pentest Tools Android
- Hacker Tools For Mac
- Hacking Tools 2020
- Hacking Tools Download
- Hacking Tools For Pc
- Hacker Tools For Ios
- Hackers Toolbox
- Pentest Tools Review
- Pentest Tools For Mac
- Hak5 Tools
- Hack Tools For Pc
- Hacking Tools Software
- Pentest Tools List
- Android Hack Tools Github
- Underground Hacker Sites
- Hacker Tools For Mac
- Hack Tools For Ubuntu
- Hacker Tools List
- Hacker Hardware Tools
- Hack Tools Github
- What Are Hacking Tools
- Hacker Tools Software
- Hacker Tools Mac
- Best Hacking Tools 2019
- Hack Website Online Tool
- Game Hacking
- Hacker Tools Windows
- Growth Hacker Tools
- Tools Used For Hacking
- Hack Tools
- Hacking Tools For Windows Free Download
- Pentest Tools Website Vulnerability
- Tools 4 Hack
- Pentest Tools Find Subdomains
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Download
- Hack Tools For Games
- Hack Tools Online
- Pentest Tools Url Fuzzer
- Pentest Tools Website Vulnerability
- Hack Tools Pc
- Tools Used For Hacking
- Hacker Tools Mac
- Underground Hacker Sites
- Hacker Tools Apk Download
- Hak5 Tools
No comments:
Post a Comment