In the first post of this DNSSEC series, I have shown the problem (DNS vulnerabilities), and in the second post, the "solution." In this third post, I am going to analyze DNSSEC. Can DNSSEC protect the users against all of the attacks? Or just part of them? What about corner cases?
The following list are the attack types from the first post, where DNSSEC can protect the users:
- DNS cache poisoning the DNS server, "Da Old way"
- DNS cache poisoning, "Da Kaminsky way"
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
The following list are the attack types from the first post, where DNSSEC cannot protect the users:
- Rogue DNS server set via malware
- Having access to the DNS admin panel and rewriting the IP
- ISP hijack, for advertisement or spying purposes
- Captive portals
- Pentester hijacks DNS to test application via active man-in-the-middle
- Malicious attacker hijacks DNS via active MITM
If you are a reader who thinks while reading, you might say "What the hell? Am I protected or not???". The problem is that it depends… In the case where the attacker is between you and your DNS server, the attacker can impersonate the DNS server, downgrade it to a non DNSSEC aware one, and send responses without DNSSEC information.
Now, how can I protect against all of these attacks? Answer is "simple":
- Configure your own DNSSEC aware server on your localhost, and use that as a resolver. This is pretty easy, even I was able to do it using tutorials.
- Don't let malware run on your system! ;-)
- Use at least two-factor authentication for admin access of your DNS admin panel.
- Use a registry lock (details in part 1).
- Use a DNSSEC aware OS.
- Use DNSSEC protected websites.
- There is a need for an API or something, where the client can enforce DNSSEC protected answers. In case the answer is not protected with DNSSEC, the connection can not be established.
Now some random facts, thoughts, solutions around DNSSEC:
- Did you know .SE signed its zone with DNSSEC in September 2005, as the first TLD in the world?
- Did you know DNSSEC was first deployed at the root level on July 15, 2010?
- Did you know .NL become the first TLD to pass 1 million DNSSEC-signed domain names?
- Did you know that Hungary is in the testing phase of DNSSEC (watch out, it is Hungarian)?
- Did you know that you can also use and test that cool DNSSEC validator?
- Did you know that there are alternative solutions like DNSCrypt?
- Did you know that in the future you might be able to enforce HSTS via DNSSEC?
- Did you know that in the future you might be able to use certificate pinning via DNSSEC?
Note from David:
Huh, I have just accidentally deleted this whole post from Z, but then I got it back from my browsing cache. Big up to Nir Sofer for his ChromeCacheView tool! Saved my ass from kickin'! :D
More information
- Beginner Hacker Tools
- Pentest Tools Find Subdomains
- Pentest Tools For Mac
- Hacking Tools Windows 10
- Hacking Tools Online
- Hack Website Online Tool
- Pentest Tools Online
- What Are Hacking Tools
- Hacker Tools Software
- Hack Tools Pc
- Pentest Tools Framework
- Pentest Tools
- Game Hacking
- Pentest Tools For Ubuntu
- Hacking Tools For Windows 7
- Hack Tools 2019
- Pentest Tools Windows
- Game Hacking
- Pentest Tools Android
- Pentest Tools
- Free Pentest Tools For Windows
- Hack Tools Download
- Pentest Tools Website Vulnerability
- Hack Tools For Pc
- Pentest Tools Kali Linux
- Pentest Tools Url Fuzzer
- Bluetooth Hacking Tools Kali
- Hack Apps
- Best Pentesting Tools 2018
- Kik Hack Tools
- Pentest Tools Kali Linux
- Hacker Tools For Ios
- Pentest Tools Apk
- How To Hack
- Pentest Tools Subdomain
- Pentest Tools Framework
- Hacking Tools For Windows Free Download
- Game Hacking
- Termux Hacking Tools 2019
- Hacker Tool Kit
- Hacker Tools Github
- Hacking Tools Pc
- Pentest Tools Download
- Computer Hacker
- Pentest Automation Tools
- Hack Tools
- Hacking Tools For Windows 7
- Hack Tools Pc
- Hacker Tools Online
- Pentest Tools Free
- Hack Tools
- Pentest Tools Framework
- Hack And Tools
- Pentest Tools Website Vulnerability
- Android Hack Tools Github
- What Is Hacking Tools
- Top Pentest Tools
- Hacking Tools Software
- Hack Tools Download
- Hack Tool Apk
- Hacker Tools Free Download
- Hacking Tools Mac
- Hacking Tools For Mac
- New Hack Tools
- Hacking Tools Hardware
- Hack Tools
- Nsa Hacker Tools
- Hacking Tools Github
- Free Pentest Tools For Windows
- Hacker Tools List
- Nsa Hacker Tools
- Growth Hacker Tools
- Beginner Hacker Tools
- Hacker
- Hacking Tools For Windows 7
- How To Hack
- Hack Tools Online
- Install Pentest Tools Ubuntu
- Nsa Hacker Tools
- Game Hacking
- Hacking Tools Free Download
- Pentest Tools Subdomain
- Pentest Tools Tcp Port Scanner
- What Are Hacking Tools
- Hacking Tools Windows 10
- Kik Hack Tools
- Github Hacking Tools
- Hacker Tool Kit
- Hacking Tools For Mac
- Growth Hacker Tools
- Github Hacking Tools
- How To Hack
- World No 1 Hacker Software
- Hack Apps
- Hacks And Tools
- Nsa Hacker Tools
- Best Hacking Tools 2019
- Hacking Tools
- Android Hack Tools Github
- Android Hack Tools Github
- Pentest Tools Framework
- Hack Tools Pc
- Easy Hack Tools
- Tools Used For Hacking
- Hack Tools Mac
- Pentest Tools Subdomain
- Android Hack Tools Github
- Hack Tool Apk
- Hacker Tools Windows
- Hack Rom Tools
- Top Pentest Tools
- Easy Hack Tools
- Tools Used For Hacking
- Tools For Hacker
- Hacking Tools Hardware
- Pentest Tools Kali Linux
- Tools 4 Hack
- Bluetooth Hacking Tools Kali
- Hacking Tools For Windows Free Download
- Pentest Tools List
- Top Pentest Tools
- Hacker Tools 2020
- Hacker Tools Free
- Hack Tools For Windows
- How To Make Hacking Tools
- Hacking Tools For Windows
- What Is Hacking Tools
- Hacker Tools List
- Pentest Tools Online
- Kik Hack Tools
- Pentest Tools Alternative
- Hacking Tools Windows
- Hacker Techniques Tools And Incident Handling
- Hak5 Tools
- Hack Tools Github
- Pentest Tools Url Fuzzer
- Wifi Hacker Tools For Windows
- Hacking Tools 2020
- Hacking Tools Download
- Hacker Tools 2019
- Pentest Tools Find Subdomains
- Hak5 Tools
- Hacking Tools 2019
- Pentest Tools Online
- Pentest Tools Apk
- Hacker Tools 2019
- Pentest Tools Online
- Pentest Tools Download
- Hacking Tools For Games
- Underground Hacker Sites
- Hacker Tools For Ios
- Pentest Tools
- Hacker Tools 2020
- Pentest Tools For Windows
- Pentest Reporting Tools
- Usb Pentest Tools
- Pentest Tools Port Scanner
- Pentest Tools Android
- Hacker Tools Apk Download
- How To Make Hacking Tools
- Hacker Tools Online
- Top Pentest Tools
- Growth Hacker Tools
- Hack Tools
- Hacker Tools Free
- Pentest Tools Find Subdomains
Sem comentários:
Enviar um comentário