Lesson 13: DNS Security. Javier Osuna GMV Head of Security and Process Consulting Division

Size: px

Start display at page:

Download "Lesson 13: DNS Security. Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division"

Louisa James
8 years ago
Views:

1 Lesson 13: DNS Security Javier Osuna GMV Head of Security and Process Consulting Division

2 Introduction to DNS The DNS enables people to use and surf the Internet, allowing the translation of easy to remember addresses into the addresses that computers understand

easy to remember addresses into the addresses that

3 DNS Architecture Hierarchical Structure top-level domains Client 3

4 DNS Architecture Hierarchical Structure Root servers: distributed worldwide and of critical security Top-level domains (TLD) General (.com,.edu,.org,.net ) National (.es,.fr,.us,.co.uk ) Domain Resolution Iterative or recursive query DNS Records 4

domains (TLD) General (.com,.edu,.org,.net ) National (.es,.

5 DNS Architecture DNS Records The database inside every DNS server uses records to organize the information record A, AAAA, CNAME, HINFO, MX, NS, PTR, SOA, SPF A = Address used to translate host server names into IPv4 addresses CNAME = Canonical Name used to create additional host server names or aliases for the domain's host servers MX (registry) = Mail Exchange associates a domain name with a list of mail exchange servers for that domain PTR = Pointer also known as 'reverse record', does the opposite of record A; it translates IP addresses into domain names 5

server names or aliases for the domain's host servers MX (registry) = Mail Exchange associates a domain name with a list of mail exchange

6 Flow of a Domain Request (Web Browser) DNS Operating System's "Hosts" File Operating System Cache Browser Cache 6

7 Basic Attacks Changing the "hosts" file Targeted User's Operating System Changing the DNS query commands Changing the DNS in the Internet connection settings Attacked DNS Changing logs 7

8 Pharming and its Purposes Attacks related to the resolution of domains are called Pharming Redirecting traffic directed to a legitimate server to a bogus one, for example: Stealing user names and passwords to access websites that require login, like: banks, social networks, online games, etc. Intercepting communications 8

one, for example: Stealing user names and passwords to access websites that

9 DNS Cache Poisoning Attack Attacker 4 1 Legitimate DNS 2 Attacking DNS Victim 9

10 DNS ID Spoofing with Sniffing Attack Bogus Web Server Victim 2 Legitimate DNS Legitimate Web Server Attacker 10

11 DNS Cache Snooping Attack The attacker sends queries to a DNS to find out the domains it has in its cache Knowing the domains others have visited: banks, political parties, medical information... Makes it easier to perform other attacks like phishing, social engineering or exploitation of vulnerabilities 11

banks, political parties, medical information.

12 Man-in-the-middle Attack Victim Attacker Legitimate Web Server 12

13 Safe Use of Domain Resolution (End Users) Local access control to the OS Updating the OS and software Installing and configuring an antivirus and a firewall Avoid installing software that isn't trusted Being aware of security alerts that browsers show us in the server certificates that are used in HTTPS connections 13

firewall Avoid installing software that isn't trusted Being aware of security

14 Securing the DNS (1 of 2) Secure Access Control User awareness of the existence and methods of social engineering Traceability of who, what and when the information contained in the DNS is modified Effective monitoring system 14

engineering Traceability of who, what and when the

15 Securing the DNS (2 of 2) Using the latest versions of the software associated with the DNS and performing regular updates Configuring the DNS appropriately Limiting, if possible, the networks from which the DNS cache is accessible 15

updates Configuring the DNS appropriately Limiting, if

16 Contact:

VIDEO Intypedia013en LESSON 13: DNS SECURITY. AUTHOR: Javier Osuna García-Malo de Molina. GMV Head of Security and Process Consulting Division

VIDEO Intypedia013en LESSON 13: DNS SECURITY AUTHOR: Javier Osuna García-Malo de Molina GMV Head of Security and Process Consulting Division Welcome to Intypedia. In this lesson we will study the DNS domain