Cyberstudy
PDF p.351 In progress

Domain Name System Attacks

Open PDF at p.351 21 flashcards

Summary

PDF p.351

DNS attacks target the domain name system to disrupt name resolution, redirect traffic, or perform denial of service (DoS) attacks. These attacks can occur on both public and private networks.

Detailed explanation

PDF p.351
  • Public Network Attacks
    • Typosquatting: Confuses users with malicious sites similar to legitimate ones.
    • DRDoS: Uses DNS in distributed reflected DoS attacks.
    • DoS Attacks: Targets public DNS services to disrupt websites or cloud resources.
    • DNS Hijacking: Inserts spoofed records in public DNS servers to redirect traffic.
  • Private Network Attacks
    • DNS Poisoning: Compromises the process of querying name servers for IP addresses.
  • Types of DNS Poisoning
    • DNS-Based On-Path Attacks
      • Mechanism: Uses ARP poisoning to respond with spoofed DNS replies.
      • Combination: May include DoS attacks on legitimate DNS servers.
      • Rogue DHCP: Configures clients with a threat actor-controlled DNS resolver.
    • DNS Client Cache Poisoning
      • Mechanism: Modifies the HOSTS file to redirect traffic.
      • Location: HOSTS file in UNIX/Linux (/etc/hosts) and Windows (%SystemRoot%\System32\Drivers\etc\hosts).
      • Indicator: Presence of suspect entries in the HOSTS file.
    • DNS Server Cache Poisoning
      • Mechanism: Corrupts DNS server records through DoS attacks and spoofed replies.
      • Recursive Queries: Attacker's DNS masquerades as authoritative server, inserting false records.
      • Tools: nslookup or dig to query and discover false records.
  • DNS Attack Indicators
    • Event Logs: Logs of DNS requests and responses.
    • Suspicious Communication: Hosts communicating with suspicious IP ranges or domains.
    • Statistical Anomalies: Spikes or large numbers of DNS lookup failures.
    • C&C Implementation: DNS used for command & control of remote access Trojans.
    • Data Exfiltration: Covert data transfer from private networks.

Important terms

taken from the text above
Typosquatting
Confuses users with malicious sites similar to legitimate ones.
DRDoS
Uses DNS in distributed reflected DoS attacks.
DoS Attacks
Targets public DNS services to disrupt websites or cloud resources.
DNS Hijacking
Inserts spoofed records in public DNS servers to redirect traffic.
DNS Poisoning
Compromises the process of querying name servers for IP addresses.
Combination
May include DoS attacks on legitimate DNS servers.
Rogue DHCP
Configures clients with a threat actor-controlled DNS resolver.
Location
HOSTS file in UNIX/Linux (/etc/hosts) and Windows (%SystemRoot%\System32\Drivers\etc\hosts).
Recursive Queries
Attacker's DNS masquerades as authoritative server, inserting false records.
Event Logs
Logs of DNS requests and responses.
Suspicious Communication
Hosts communicating with suspicious IP ranges or domains.
Statistical Anomalies
Spikes or large numbers of DNS lookup failures.
C&C Implementation
DNS used for command & control of remote access Trojans.
Data Exfiltration
Covert data transfer from private networks.

What I should remember

Key Points PDF p.351
  • Public Network Attacks
    • Typosquatting: Confuses users.
    • DRDoS: Uses DNS in DoS attacks.
    • DoS Attacks: Targets DNS services.
    • DNS Hijacking: Redirects traffic.
  • Private Network Attacks
    • DNS Poisoning: Compromises name resolution.
  • Types of DNS Poisoning
    • On-Path Attacks: ARP poisoning, rogue DHCP.
    • Client Cache Poisoning: Modifies HOSTS file.
    • Server Cache Poisoning: Corrupts server records.
  • DNS Attack Indicators
    • Event Logs: DNS request logs.
    • Suspicious Communication: With suspicious IPs/domains.
    • Anomalies: Lookup failures.
    • C&C Implementation: For remote access Trojans.
    • Data Exfiltration: Covert transfers.