Skip to main content

Domain Name Service

While the DNS software BIND has vulnerabilities associated with it, the DNS service in general also has exposures that affect security. Systems use DNS to resolve host names to IP addresses and vice versa. Unfortunately, many servers are configured to provide too much information about a network. For instance, a DNS server can be misconfigured to allow zone transfers by which an attacker can obtain host information about an entire domain. In addition, DNS records may provide unnecessary information, such as the address of the internal servers, text lines, system secondary names, and system roles that an attacker could use to formulate an attack.

Organizations should verify the information their DNS servers are providing to ensure no unnecessary information can be obtained from the Internet. In addition, administrators should configure DNS servers to restrict zone transfers. Discovery tools are helpful for performing zone transfers and DNS queries to review the information provided by the server.

Unfortunately, since these servers need to be accessible from the Internet in order to provide the?service, they are also a popular target for attackers. Steps should be taken to make sure the DNS server has been securely configured and that the system (hardware, operating system, and any applications running on it) is updated and monitored for vulnerabilities. Zone transfers should be limited to specific IP addresses that require the ability to update zone information. Vulnerability scanners and discovery tools can be used to help identify exposures in DNS implementations
Labels:

Comments

Post a Comment

Popular posts from this blog

Password Crackers

There are password crackers for almost every password-protected system available. A quick search on the Internet identifies password crackers for Windows NT, UNIX, Novell, PGP, Word, VNC, pcAnywhere, Lotus Notes, Cisco routers, WinZip, and many others. Password crackers can be effective tools to use during penetration testing to help ensure users are selecting strong passwords. If a strong password is used, password crackers can take weeks, months, or even years to crack it. If a weak password is used, the cracker could succeed in hours, minutes, or even seconds. In this chapter we concentrate on OS-specific password crackers and describe their use during testing. L0phtCrack URL: www.L0pht.com Client OS: Windows 9x/NT Target OS: Windows NT Price: Under $100 Description:  L0phtCrack is the premier NT password cracker. The first version provided administrators the ability to extract user names and encrypted password hashes from the SAM database and perform a dictionary and brute for...
Post a Comment
Read more

How AI can change the world?

There are many ways in which AI (artificial intelligence) can change the world, both positive and negative. Some potential impacts include: Improved decision-making: AI algorithms can analyze large amounts of data quickly and accurately, allowing businesses and governments to make more informed decisions. Increased efficiency: AI-powered systems can automate tasks and processes, freeing up human workers to focus on more complex tasks. Enhanced healthcare: AI can be used to analyze patient data and diagnose diseases more accurately, improving patient outcomes and reducing healthcare costs. Increased safety: AI can be used in transportation, such as self-driving cars, to reduce accidents and improve safety on the roads. Environmental benefits: AI can be used to optimize energy usage, reducing waste and helping to reduce greenhouse gas emissions. However, there are also potential negative impacts of AI, such as job displacement and the potential for AI to be used for nefarious purposes, s...
Post a Comment
Read more

Nmap

URL: www.insecure.org/nmap/ Client OS: UNIX, Windows NT (ported by eEye Digital Security) Target OS: TCP/IP networks Classification: Discovery tool Price: Free Description:  While Nmap is a most powerful port scanner, it can also serve as a more sophisticated ping sweep utility. In this chapter, we discuss only Nmap's ping capability. If the target network is blocking ICMP ECHO requests and replies, Pinger and other normal ping utilities will not be able to identify any active systems. Additionally, the target network may have the most crucial systems configured to not respond to ICMP ping but may allow some nonessential systems to respond to ICMP ping to trick attackers. By finding some interesting hosts that respond to ping, the attacker may not think to use a more sophisticated ping tool to identify hosts not responding to ICMP ping. Nmap provides the capability to perform TCP pings on TCP ports rather than the usual ICMP that everyone associates w...
Post a Comment
Read more