DNS Attack

 What is a DNS Attack

A Domain Name System (DNS) attack is where cyber-criminals exploit vulnerabilities found in the Domain Name System (DNS) of a server. The purpose of the domain name system is to translate user-friendly domain names into machine-readable IP addresses, via a DNS resolver.

Types of DNS Attack

There are many different types of DNS attacks, whose purpose is to exploit vulnerabilities found in the three types of DNS servers. These include the DNS stub resolver server, DNS recursive resolver server, and DNS authoritative server.

Zero-day attack: This is where the attacker exploits DNS software vulnerabilities that were previously unknown to the victims.

Cache poisoning: Cache poisoning is where the attacker tricks DNS resolvers into caching false information, such as IP addresses, in an attempt to redirect traffic to a malicious website.

Distributed Denial of Service (DDoS): This is where an attacker floods a DNS server with traffic in order to cause disruption and make it unavailable to its intended users. Unlike a simple Denial of Service (DoS) attack which sends traffic from a single device, a DDoS attack will use a botnet, which usually involves compromising random devices on different networks, in order to send large amounts of distributed traffic to the target server.

DNS amplification: A DNS amplification attack is a type of DDoS attack where the adversary sends a DNS query with a forged IP address to an open DNS resolver, prompting it to send back a response to a fake IP address, which might be another open DNS resolver. By continuously sending out these queries, a network can very quickly become overwhelmed with traffic.

Fast-flux DNS: DNS fast fluxing involves associating multiple IP addresses with a single domain name, and then rapidly swapping the IP addresses in order to make it harder to track and block malicious domains.

DNS tunneling: While not directly an attack on DNS, DNS tunneling provides a way for attackers to infect a victim’s system in order to establish a tunnel, which can be used to either exfiltrate data or implant malware on their system.

1. How to Prevent DNS attacks
2. Use the latest DNS software
3. Use multi-factor authentication (MFA)
4. Implement Domain Name System Security Extensions (DNSSEC)
5. Isolate your DNS server
6. Audit your DNS zones
7. Hide your BIND version
8. Restrict DNS zone transfers
9. Disable DNS recursion
10. Use a DDoS mitigation provider
11. Continuously monitor network traffic

Author

Gouttam Rajpurohit