DNS Vulnerabilities - Revision history

SGross at 11:03, 11 December 2024

2024-12-11T11:03:47Z

← Older revision		Revision as of 11:03, 11 December 2024
Line 1:		Line 1:
	~~WORK IN PROGRESS~~

	== Introduction ==		== Introduction ==

SGross: /* DNS Overview */

2024-12-11T11:03:32Z

DNS Overview

← Older revision		Revision as of 11:03, 11 December 2024
Line 12:		Line 12:
	The process of DNS resolution is illustrated below.		The process of DNS resolution is illustrated below.

	[[File:DNS_Process.png\|thumb\|none\|600px\|Figure 1: DNS Name Resolution Process <ref name="Gross2024">Gross, Stella. (2024). Representations from [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] nd were accordingly adapted by the author Gross, Stella.</ref> ]]		[[File:DNS_Process.png\|thumb\|none\|600px\|Figure 1: DNS Name Resolution Process <ref name="Gross2024">Gross, Stella. (2024). Representations from [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] and were accordingly adapted by the author Gross, Stella.</ref> ]]

SGross: /* DNS Cache Poisoning */

2024-12-11T11:03:21Z

DNS Cache Poisoning

← Older revision		Revision as of 11:03, 11 December 2024
Line 36:		Line 36:
	The mechanics of a DNS cache poisoning attack are depicted below.		The mechanics of a DNS cache poisoning attack are depicted below.

	[[File:CachePoisoning.png\|thumb\|none\|600px\|Figure 2: DNS cache poisoning attack process <ref name="Gross2024">Gross, Stella. (2024). Representations from [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] nd were accordingly adapted by the author Gross, Stella.</ref> ]]		[[File:CachePoisoning.png\|thumb\|none\|600px\|Figure 2: DNS cache poisoning attack process <ref name="Gross2024">Gross, Stella. (2024). Representations from [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] and were accordingly adapted by the author Gross, Stella.</ref> ]]

	=== Real-World Incident: Kaminski Attack ===		=== Real-World Incident: Kaminski Attack ===

SGross: /* DNS Vulnerabilities */

2024-12-11T11:02:52Z

DNS Vulnerabilities

← Older revision		Revision as of 11:02, 11 December 2024
Line 36:		Line 36:
	The mechanics of a DNS cache poisoning attack are depicted below.		The mechanics of a DNS cache poisoning attack are depicted below.

	[[File:CachePoisoning.png\|thumb\|none\|600px\|Figure 2: DNS cache poisoning attack process <ref name="Gross2024">Gross, Stella. (2024). ~~Darstellungen aus~~ [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] ~~und wurde entsprechend von Verfasser~~ Gross, Stella ~~angepasst~~.</ref> ]]		[[File:CachePoisoning.png\|thumb\|none\|600px\|Figure 2: DNS cache poisoning attack process <ref name="Gross2024">Gross, Stella. (2024). Representations from [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] nd were accordingly adapted by the author Gross, Stella.</ref> ]]

	=== Real-World Incident: Kaminski Attack ===		=== Real-World Incident: Kaminski Attack ===

SGross: /* DNS Overview */

2024-12-11T11:02:32Z

DNS Overview

← Older revision		Revision as of 11:02, 11 December 2024
Line 12:		Line 12:
	The process of DNS resolution is illustrated below.		The process of DNS resolution is illustrated below.

	[[File:DNS_Process.png\|thumb\|none\|600px\|Figure 1: DNS Name Resolution Process <ref name="Gross2024">Gross, Stella. (2024). ~~Darstellungen aus~~ [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] ~~und wurde entsprechend von Verfasser~~ Gross, Stella ~~angepasst~~.</ref> ]]		[[File:DNS_Process.png\|thumb\|none\|600px\|Figure 1: DNS Name Resolution Process <ref name="Gross2024">Gross, Stella. (2024). Representations from [Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699, 2021] nd were accordingly adapted by the author Gross, Stella.</ref> ]]


	'''How DNS Resolution Works'''		'''How DNS Resolution Works'''

SGross: /* DNS Overview */

2024-12-11T11:00:00Z

DNS Overview

← Older revision		Revision as of 11:00, 11 December 2024
Line 8:		Line 8:
	== DNS Overview ==		== DNS Overview ==

	DNS operates as a hierarchical and decentralized naming system that relies on multiple layers of servers—root servers, TLD servers, and authoritative DNS servers. These servers work together to ~~resolve queries and~~ provide the IP addresses associated with domain names.<ref name="Khormali2021">Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. (2021). Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699.</ref>		DNS operates as a hierarchical and decentralized naming system that relies on multiple layers of servers—root servers, TLD servers, and authoritative DNS servers. These servers work together to provide the IP addresses associated with domain names.<ref name="Khormali2021">Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. (2021). Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699.</ref>

	The process of DNS resolution is illustrated below.		The process of DNS resolution is illustrated below.

SGross: /* DNS Cache Poisoning */

2024-12-08T21:29:11Z

DNS Cache Poisoning

← Older revision		Revision as of 21:29, 8 December 2024
Line 32:		Line 32:
	* Correctly guess the transaction ID and UDP source port used in the original query.		* Correctly guess the transaction ID and UDP source port used in the original query.
	* Inject the forged response before the legitimate server replies.<ref name="Khormali2021">Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. (2021). Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699.</ref>		* Inject the forged response before the legitimate server replies.<ref name="Khormali2021">Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. (2021). Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699.</ref>


	The mechanics of a DNS cache poisoning attack are depicted below.		The mechanics of a DNS cache poisoning attack are depicted below.

SGross: /* Countermeasures */

2024-12-08T21:28:52Z

Countermeasures

← Older revision		Revision as of 21:28, 8 December 2024
Line 56:		Line 56:
	* '''DNSCrypt''': Encrypts DNS queries and responses, ensuring confidentiality between clients and resolvers. This is particularly useful for preventing on-path attacks.		* '''DNSCrypt''': Encrypts DNS queries and responses, ensuring confidentiality between clients and resolvers. This is particularly useful for preventing on-path attacks.
	* '''DNS-over-TLS (DoT)''': Encrypts DNS traffic using TLS, protecting against interception and amplification attacks.		* '''DNS-over-TLS (DoT)''': Encrypts DNS traffic using TLS, protecting against interception and amplification attacks.
	* '''DNS-over-HTTPS (DoH)''': Encapsulates DNS queries within HTTPS traffic, making it harder to identify and block DNS queries.		* '''DNS-over-HTTPS (DoH)''': Encapsulates DNS queries within HTTPS traffic, making it harder to identify and block DNS queries.<ref name="Schmid2021">Giovanni Schmid. (2021). Thirty years of DNS insecurity: Current issues and perspectives. IEEE Communications Surveys & Tutorials, 23:2429–2459.</ref>

	== Conclusion ==		== Conclusion ==

SGross: /* Real-World Incident: Kaminski Attack */

2024-12-08T21:28:30Z

Real-World Incident: Kaminski Attack

← Older revision		Revision as of 21:28, 8 December 2024
Line 41:		Line 41:
	In 2008, Dan Kaminski demonstrated a vulnerability in DNS systems, now known as the Kaminski attack. At the time, most DNS resolvers used static source ports, significantly reducing the difficulty of cache poisoning. Kaminski showed that attackers could predict transaction IDs and ports, making it easier to inject forged responses.		In 2008, Dan Kaminski demonstrated a vulnerability in DNS systems, now known as the Kaminski attack. At the time, most DNS resolvers used static source ports, significantly reducing the difficulty of cache poisoning. Kaminski showed that attackers could predict transaction IDs and ports, making it easier to inject forged responses.

	Although modern DNS systems employ randomization for both transaction IDs and source ports, attackers must now guess 32 random bits (16 bits each for the transaction ID and source port), resulting in over 4 billion possible combinations.		Although modern DNS systems employ randomization for both transaction IDs and source ports, attackers must now guess 32 random bits (16 bits each for the transaction ID and source port), resulting in over 4 billion possible combinations.<ref name="Kaminsky2008">Dan Kaminsky. (2008). Black ops 2008: It’s the end of the cache as we know it. In Black Hat USA Conference. IOActive, Inc. Presented at Black Hat USA 2008.</ref>

	== Countermeasures ==		== Countermeasures ==

SGross: /* DNS Cache Poisoning */

2024-12-08T21:28:13Z

DNS Cache Poisoning

← Older revision		Revision as of 21:28, 8 December 2024
Line 31:		Line 31:
	* Spoof the source IP address to match the legitimate DNS server.		* Spoof the source IP address to match the legitimate DNS server.
	* Correctly guess the transaction ID and UDP source port used in the original query.		* Correctly guess the transaction ID and UDP source port used in the original query.
	* Inject the forged response before the legitimate server replies.		* Inject the forged response before the legitimate server replies.<ref name="Khormali2021">Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. (2021). Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699.</ref>


	<ref name="Khormali2021">Aminollah Khormali, Jeman Park, Hisham Alasmary, Afsah Anwar, Muhammad Saad, and David Mohaisen. (2021). Domain name system security and privacy: A contemporary survey. Computer Networks, 185:107699.</ref>