In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post, the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases?
The following list are the attack types from the first post, where DNSSEC can protect the users:
- DNS cache poisoning the DNS server, "Da Old way"
- DNS cache poisoning, "Da Kaminsky way"
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
The following list are the attack types from the first post, where DNSSEC cannot protect the users:
- Rogue DNS server set via malware
- Having access to the DNS admin panel and rewriting the IP
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
If you are a reader who thinks while reading, you might say "What the hell? Am I protected or not???". The problem is that it depends… In the case where the attacker is between you and your DNS server, the attacker can impersonate the DNS server, downgrade it to a non DNSSEC aware one, and send responses without DNSSEC information.
Now, how can I protect against all of these attacks? Answer is "simple":
- Configure your own DNSSEC aware server on your localhost, and use that as a resolver. This is pretty easy, even I was able to do it using tutorials.
- Don't let malware run on your system! ;-)
- Use at least two-factor authentication for admin access of your DNS admin panel.
- Use a registry lock (details in part 1).
- Use a DNSSEC aware OS.
- Use DNSSEC protected websites.
- There is a need for an API or something, where the client can enforce DNSSEC protected answers. In case the answer is not protected with DNSSEC, the connection can not be established.
Now some random facts, thoughts, solutions around DNSSEC:
- Did you know .SE signed its zone with DNSSEC in September 2005, as the first TLD in the world?
- Did you know DNSSEC was first deployed at the root level on July 15, 2010?
- Did you know .NL become the first TLD to pass 1 million DNSSEC-signed domain names?
- Did you know that Hungary is in the testing phase of DNSSEC (watch out, it is Hungarian)?
- Did you know that you can also use and test that cool DNSSEC validator?
- Did you know that there are alternative solutions like DNSCrypt?
- Did you know that in the future you might be able to enforce HSTS via DNSSEC?
- Did you know that in the future you might be able to use certificate pinning via DNSSEC?
Note from David:
Huh, I have just accidentally deleted this whole post from Z, but then I got it back from my browsing cache. Big up to Nir Sofer for his ChromeCacheView tool! Saved my ass from kickin'! :D
Continue reading- Hacker Tools Apk
- Best Hacking Tools 2019
- Hacker Tools Apk
- New Hacker Tools
- Hacking Tools Mac
- Hacking Tools Github
- Hacker Tools For Mac
- Hacking Tools Kit
- Hacker Tools Free Download
- Hack Website Online Tool
- How To Make Hacking Tools
- Hack And Tools
- Hacker Tools For Windows
- Pentest Tools Port Scanner
- Blackhat Hacker Tools
- Hacking Tools And Software
- Nsa Hack Tools Download
- Hacker Tools Online
- Nsa Hack Tools Download
- Nsa Hacker Tools
- What Are Hacking Tools
- Hack Tools For Mac
- Hacker Tools For Windows
- What Are Hacking Tools
- Hacker Tools
- Hack Tools For Mac
- Hack App
- Hacker Hardware Tools
- Bluetooth Hacking Tools Kali
- Hackrf Tools
- Top Pentest Tools
- Pentest Tools Free
- Hacking Tools Windows
- Growth Hacker Tools
- Usb Pentest Tools
- Hackers Toolbox
- Hacking Tools For Windows Free Download
- Hacker Search Tools
- Pentest Tools For Ubuntu
- Hacker Tools Hardware
- Pentest Tools Port Scanner
- Hacker Tools
- Hacking Tools Windows 10
- Nsa Hack Tools Download
- Hacking Tools For Games
- Top Pentest Tools
- Hack Tool Apk No Root
- Hacking Tools For Kali Linux
- Underground Hacker Sites
- Underground Hacker Sites
- Hacker Tools List
- Pentest Tools Alternative
- Hacker Tools 2020
- Hacking Tools For Games
- Pentest Tools For Ubuntu
- Pentest Tools Website
- Nsa Hack Tools
- Hacking Tools Usb
- Hack Tools
- Hacker Tools
- Free Pentest Tools For Windows
- Github Hacking Tools
- Pentest Box Tools Download
- Hacker Search Tools
- Pentest Tools Windows
- Tools 4 Hack
- New Hacker Tools
- Hacking Tools And Software
- Pentest Tools List
- Blackhat Hacker Tools
- How To Hack
- Hacker Tools List
- Wifi Hacker Tools For Windows
- Hacking Tools Usb
- Hacker Tools List
- Hacker Tools Free Download
- Pentest Automation Tools
- Hacking Tools Kit
- Hacker Techniques Tools And Incident Handling
- Hacker Search Tools
- Hacking Tools Download
- Hack App
- Hacker Tools Apk
- Hacker Tools Windows
- Hack Tools For Pc
- Pentest Tools For Ubuntu
- Pentest Tools For Windows
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Mac
- Pentest Tools Url Fuzzer
- Pentest Tools Website Vulnerability
- Hacker Tools Hardware
- Hack Tools Pc
- Hacking Tools 2020
- Hack Tool Apk
- Pentest Tools For Android
- Hacker Tools List
- Hack Tool Apk
- Hacker Tools
- Hacker Search Tools
- Hacking Tools Name
- Pentest Box Tools Download
- Hacker Tools Apk
- Hak5 Tools
- Hack And Tools
- Pentest Tools Website Vulnerability
- Github Hacking Tools
- Pentest Tools Apk
- Hacking Tools Github
- Hak5 Tools
- Hacker Tools Software
- Hacker
- Hack Tools Pc
- Hacking Tools Kit
- Pentest Tools Android
- Hacker Tool Kit
- Pentest Tools Windows
- Hacking Tools 2019
- Hack Tool Apk
- Hack Tools 2019
- Hacking Tools For Windows
- Top Pentest Tools
- Pentest Tools Apk
- Bluetooth Hacking Tools Kali
- Hack Rom Tools
- Hack Tools
- Pentest Tools Nmap
- Hack Tools For Mac
- Hack And Tools
- Hacking App
- Hacker Tools Hardware
- Hacking Tools
- Ethical Hacker Tools
- Pentest Tools Bluekeep
- Best Pentesting Tools 2018
- What Are Hacking Tools
- Hacking Tools For Kali Linux
- Hacking Tools Mac
- Pentest Tools Open Source
- Hacking App
- Computer Hacker
- Hacker Tools
- Hacking Tools For Windows 7
- Pentest Box Tools Download
- Hacking Tools 2019
- Hacking Tools For Pc
- Hacking Tools 2019
- Pentest Tools Kali Linux
- Pentest Automation Tools
- Pentest Automation Tools
- Pentest Tools Alternative
- Hack App
- Hack Tools 2019
- Pentest Automation Tools
No comments:
Post a Comment