In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post, the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases?
The following list are the attack types from the first post, where DNSSEC can protect the users:
- DNS cache poisoning the DNS server, "Da Old way"
- DNS cache poisoning, "Da Kaminsky way"
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
The following list are the attack types from the first post, where DNSSEC cannot protect the users:
- Rogue DNS server set via malware
- Having access to the DNS admin panel and rewriting the IP
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
If you are a reader who thinks while reading, you might say "What the hell? Am I protected or not???". The problem is that it depends… In the case where the attacker is between you and your DNS server, the attacker can impersonate the DNS server, downgrade it to a non DNSSEC aware one, and send responses without DNSSEC information.
Now, how can I protect against all of these attacks? Answer is "simple":
- Configure your own DNSSEC aware server on your localhost, and use that as a resolver. This is pretty easy, even I was able to do it using tutorials.
- Don't let malware run on your system! ;-)
- Use at least two-factor authentication for admin access of your DNS admin panel.
- Use a registry lock (details in part 1).
- Use a DNSSEC aware OS.
- Use DNSSEC protected websites.
- There is a need for an API or something, where the client can enforce DNSSEC protected answers. In case the answer is not protected with DNSSEC, the connection can not be established.
Now some random facts, thoughts, solutions around DNSSEC:
- Did you know .SE signed its zone with DNSSEC in September 2005, as the first TLD in the world?
- Did you know DNSSEC was first deployed at the root level on July 15, 2010?
- Did you know .NL become the first TLD to pass 1 million DNSSEC-signed domain names?
- Did you know that Hungary is in the testing phase of DNSSEC (watch out, it is Hungarian)?
- Did you know that you can also use and test that cool DNSSEC validator?
- Did you know that there are alternative solutions like DNSCrypt?
- Did you know that in the future you might be able to enforce HSTS via DNSSEC?
- Did you know that in the future you might be able to use certificate pinning via DNSSEC?
Note from David:
Huh, I have just accidentally deleted this whole post from Z, but then I got it back from my browsing cache. Big up to Nir Sofer for his ChromeCacheView tool! Saved my ass from kickin'! :D
More information- Hack Apps
- Hacker Tools For Mac
- Pentest Tools Download
- Nsa Hack Tools
- World No 1 Hacker Software
- Pentest Tools Tcp Port Scanner
- Pentest Tools
- Hacker Security Tools
- Hackers Toolbox
- Pentest Tools Port Scanner
- Pentest Tools Open Source
- Pentest Tools Linux
- Pentest Tools Kali Linux
- Github Hacking Tools
- Hacker Hardware Tools
- Pentest Automation Tools
- Hacking Tools For Mac
- Hack And Tools
- Hacking Tools Online
- Pentest Tools
- Game Hacking
- Pentest Box Tools Download
- Hacking Tools
- Tools 4 Hack
- World No 1 Hacker Software
- Hacking Tools Kit
- Pentest Tools For Mac
- Hacking Tools For Kali Linux
- Hacking Tools Name
- How To Make Hacking Tools
- Pentest Tools Nmap
- Nsa Hacker Tools
- Hacker Tools Apk
- Pentest Tools
- Hacker Tools Online
- Hacker Tools Linux
- Hack Tools Download
- Tools 4 Hack
- Best Pentesting Tools 2018
- Pentest Tools List
- Tools 4 Hack
- Pentest Tools For Windows
- Hacking Tools For Windows 7
- World No 1 Hacker Software
- Pentest Tools Open Source
- Install Pentest Tools Ubuntu
- Underground Hacker Sites
- Tools 4 Hack
- Hacker Tools Apk Download
- Pentest Tools Review
- Hacking Tools For Beginners
- Hacking Tools For Kali Linux
- Hacking Tools Free Download
- Best Pentesting Tools 2018
- Github Hacking Tools
- Hacker Tools Linux
- Pentest Tools Download
- Hacking Tools For Pc
- Hacking Tools For Mac
- Hacker Tools Mac
- Hack Website Online Tool
- Kik Hack Tools
- Pentest Tools Online
- Pentest Tools Download
- Hacking Tools Name
- Pentest Tools Subdomain
- Hacking Tools Mac
- Hacker Tools Mac
- Pentest Tools Tcp Port Scanner
- Pentest Tools Nmap
- What Is Hacking Tools
- Growth Hacker Tools
- Hacker Tools List
- Physical Pentest Tools
- How To Hack
- Blackhat Hacker Tools
- Hack Tool Apk No Root
- Hacking App
- Hacker Tools 2019
- Hacker Tools Windows
- Pentest Tools Website Vulnerability
- Pentest Tools For Windows
- Github Hacking Tools
- Tools For Hacker
- Hack Tools Mac
- Pentest Tools Open Source
- Beginner Hacker Tools
- Pentest Tools For Ubuntu
- Top Pentest Tools
- Hack Tools For Games
- Hacking Tools Mac
- Wifi Hacker Tools For Windows
- Hacker Tools List
- Pentest Tools For Windows
- World No 1 Hacker Software
- Hack Tools Mac
- Pentest Tools Online
- Best Pentesting Tools 2018
- Pentest Tools Nmap
- Hacker Tools Apk Download
- Pentest Tools
- Pentest Reporting Tools
- Hack Tools Download
- Hack Tools Github
- Hak5 Tools
- Pentest Tools Alternative
- Termux Hacking Tools 2019
- What Is Hacking Tools
- Hackers Toolbox
- Pentest Tools Linux
- Hacking Tools Software
- Install Pentest Tools Ubuntu
- Hacker Hardware Tools
- Hacking Tools Windows
- Hacking Tools Name
- Hacker Tools Software
- Hacking Tools For Windows
- Hacking Apps
- Hacker Tools Mac
No comments:
Post a Comment