DNS Value and Vulnerability: Difference between revisions

(3 intermediate revisions by 2 users not shown)

Line 4:

'''The Root File:''' At the top of the [[DNS]] structure is the [[Root File|root file]]. The root file contains the basic information for each Top Level Domain ([[TLD]]) that exists on the Internet. Such [[TLD]]s include .com, .org and .net to name a few. This list also includes code that reflect countries and regions who have a distinct presence on the Internet, such as .SG for Singapore, .UA for the Ukraine, .NZ for New Zealand and .EU for the European Union, also to name a few. Redundant instances of the root file are located throughout the globe for purposes of redundancy and resiliency.

'''How DNS Works:''' The operation of [[DNS]] remains a mystery for the majority of those using the Internet today. Each name server encountered along the way is known as a recursive name server as it’s job is to provide your browser with an address of a suggested name server that will be one step closer in obtaining the specific [[IP address]] of the desired destination site. In this case the name server that yields the actual IP address is known as the authoritative ~~[[Name Server|~~name server]]. Here is a brief example of how the Internet works. For purposes of this example we will be locating the destination site of [[CommunityDNS]], or http://www.communitydns.net.

'''How DNS Works:''' The operation of [[DNS]] remains a mystery for the majority of those using the Internet today. Each name server encountered along the way is known as a recursive name server as it’s job is to provide your browser with an address of a suggested name server that will be one step closer in obtaining the specific [[IP address]] of the desired destination site. In this case the name server that yields the actual IP address is known as the authoritative name server. Here is a brief example of how the Internet works. For purposes of this example we will be locating the destination site of [[CommunityDNS]], or http://www.communitydns.net.

# You, the user, enters www.communitydns.net in the address bar of your browser.

# Your browser sends a request to the DNS server of your respective ISP.

# Your [[ISP]]’s [[DNS]] server does not have a destination [[IP address]] for communitydns.net so then informs your browser to query the root servers at the top of the global [[DNS]] hierarchy. Your [[ISP]] has a list of all of the ~~[[Root Server|~~root servers]] around the globe and rotates through this list to determine which root server your browser will ultimately send its request to. Your request could go to a root server nearest you or half way around the world.

# Your [[ISP]]’s [[DNS]] server does not have a destination [[IP address]] for communitydns.net so then informs your browser to query the root servers at the top of the global [[DNS]] hierarchy. Your [[ISP]] has a list of all of the root servers around the globe and rotates through this list to determine which root server your browser will ultimately send its request to. Your request could go to a root server nearest you or half way around the world.

# Your browser sends its request for www.communitydns.net to the root server. Since the root servers only know the destination of [[TLD]]s your browser is returned the address of the registry name servers that are responsible for the .net TLD. In this case Verisign is the registry for the .net TLD.

# The .net name servers will see that “CommunityDNS” belongs to a specific network provider, thus returning to the browser the IP address of the next name server along the path.

Line 17:

The process is simple, straight forward and elegant. However, “Simple, straight forward and elegant” does not mean it is without flaw.

'''Vulnerability:''' As with any case, the old saying of “The chain is only as strong as its weakest link” applies here. Also, the more links there are in the chain the greater opportunity, or opportunities for failure. In this case the vulnerability rests with people trying to hijack unsuspected users by redirecting them to a site for criminal activity. For example, you wish to conduct an online transaction at a site you are familiar with, whether your bank or an online retail site. Criminals will want to hijack your session so that you wind up on their site instead of the one you originally intended to visit. Such hijacking could result in you innocently handing over your bank login or credit card information to criminals. From a national security perspective criminals could attempt to hijack the code of a given country, such as anything destined with the .na, or Namibia, [[TLD]].

'''Vulnerability:''' As with any case, the old saying of “The chain is only as strong as its weakest link” applies here. Also, the more links there are in the chain the greater opportunity, or opportunities for failure. In this case the vulnerability rests with people trying to hijack unsuspected users by redirecting them to a site for criminal activity. This is a kind of [https://secure.wphackedhelp.com/blog/wordpress-malware-redirect-hack-cleanup/ redirect hack] which is widely seen in WordPress sites. For example, you wish to conduct an online transaction at a site you are familiar with, whether your bank or an online retail site. Criminals will want to hijack your session so that you wind up on their site instead of the one you originally intended to visit. Such hijacking could result in you innocently handing over your bank login or credit card information to criminals. From a national security perspective criminals could attempt to hijack the code of a given country, such as anything destined with the .na, or Namibia, [[TLD]].

'''Exploiting the vulnerability:''' Criminals hijack sessions by targeting recursive, or non-authoritative name servers and poisoning the cache that resides within a specific recursive name server. In the earlier example eight distinct steps were identified from when a user first enters a destination in their browser to when the browser actually connects to the destination site. Four of the seven steps deal with redirecting, or bouncing your browser from one recursive name server to another, all narrowing in on the desired destination. In this case the name servers that redirected queries were:

# Your [[ISP]]’s name server

# The ~~[[Root Server|~~root servers]]

# The root servers

# The [[TLD]] name servers

# The name servers of the destination server’s network provider

Line 31:

So while the global [[DNS]] hierarchy is designed for a logical method for navigating the Internet, vulnerabilities exist that can impact your firm’s brand, business stability as well as the global economic presence countries are building by using the Internet. Having a strong business resiliency plan will help mitigate threats posed to your customers, your company and your country.

__FORCETOC__

~~__NOTOC__~~

__NOEDITSECTION__

@@ Line 4: / Line 4: @@
 '''The Root File:'''  At the top of the [[DNS]] structure is the [[Root File|root file]].  The root file contains the basic information for each Top Level Domain ([[TLD]]) that exists on the Internet.  Such [[TLD]]s include .com, .org and .net to name a few.  This list also includes code that reflect countries and regions who have a distinct presence on the Internet, such as .SG for Singapore, .UA for the Ukraine, .NZ for New Zealand and .EU for the European Union, also to name a few.  Redundant instances of the root file are located throughout the globe for purposes of redundancy and resiliency.
-'''How DNS Works:'''  The operation of [[DNS]] remains a mystery for the majority of those using the Internet today.  Each name server encountered along the way is known as a recursive name server as it’s job is to provide your browser with an address of a suggested name server that will be one step closer in obtaining the specific [[IP address]] of the desired destination site.  In this case the name server that yields the actual IP address is known as the authoritative [[Name Server|name server]].  Here is a brief example of how the Internet works.  For purposes of this example we will be locating the destination site of [[CommunityDNS]], or http://www.communitydns.net.
+'''How DNS Works:'''  The operation of [[DNS]] remains a mystery for the majority of those using the Internet today.  Each name server encountered along the way is known as a recursive name server as it’s job is to provide your browser with an address of a suggested name server that will be one step closer in obtaining the specific [[IP address]] of the desired destination site.  In this case the name server that yields the actual IP address is known as the authoritative name server.  Here is a brief example of how the Internet works.  For purposes of this example we will be locating the destination site of [[CommunityDNS]], or http://www.communitydns.net.
 # You, the user, enters www.communitydns.net in the address bar of your browser.<br>
 # Your browser sends a request to the DNS server of your respective ISP.<br>
-# Your [[ISP]]’s [[DNS]] server does not have a destination [[IP address]] for communitydns.net so then informs your browser to query the root servers at the top of the global [[DNS]] hierarchy.  Your [[ISP]] has a list of all of the [[Root Server|root servers]] around the globe and rotates through this list to determine which root server your browser will ultimately send its request to.  Your request could go to a root server nearest you or half way around the world.<br>
+# Your [[ISP]]’s [[DNS]] server does not have a destination [[IP address]] for communitydns.net so then informs your browser to query the root servers at the top of the global [[DNS]] hierarchy.  Your [[ISP]] has a list of all of the root servers around the globe and rotates through this list to determine which root server your browser will ultimately send its request to.  Your request could go to a root server nearest you or half way around the world.<br>
 # Your browser sends its request for www.communitydns.net to the root server.  Since the root servers only know the destination of [[TLD]]s your browser is returned the address of the registry name servers that are responsible for the .net TLD.  In this case Verisign is the registry for the .net TLD.<br>
 # The .net name servers will see that “CommunityDNS” belongs to a specific network provider, thus returning to the browser the IP address of the next name server along the path.<br>
@@ Line 17: / Line 17: @@
 The process is simple, straight forward and elegant.  However, “Simple, straight forward and elegant” does not mean it is without flaw.
-'''Vulnerability:'''  As with any case, the old saying of “The chain is only as strong as its weakest link” applies here.  Also, the more links there are in the chain the greater opportunity, or opportunities for failure.  In this case the vulnerability rests with people trying to hijack unsuspected users by redirecting them to a site for criminal activity.  For example, you wish to conduct an online transaction at a site you are familiar with, whether your bank or an online retail site.  Criminals will want to hijack your session so that you wind up on their site instead of the one you originally intended to visit.  Such hijacking could result in you innocently handing over your bank login or credit card information to criminals.  From a national security perspective criminals could attempt to hijack the code of a given country, such as anything destined with the .na, or Namibia, [[TLD]].
+'''Vulnerability:'''  As with any case, the old saying of “The chain is only as strong as its weakest link” applies here.  Also, the more links there are in the chain the greater opportunity, or opportunities for failure.  In this case the vulnerability rests with people trying to hijack unsuspected users by redirecting them to a site for criminal activity. This is a kind of [https://secure.wphackedhelp.com/blog/wordpress-malware-redirect-hack-cleanup/ redirect hack] which is widely seen in WordPress sites.  For example, you wish to conduct an online transaction at a site you are familiar with, whether your bank or an online retail site.  Criminals will want to hijack your session so that you wind up on their site instead of the one you originally intended to visit.  Such hijacking could result in you innocently handing over your bank login or credit card information to criminals.  From a national security perspective criminals could attempt to hijack the code of a given country, such as anything destined with the .na, or Namibia, [[TLD]].
 '''Exploiting the vulnerability:'''  Criminals hijack sessions by targeting recursive, or non-authoritative name servers and poisoning the cache that resides within a specific recursive name server.  In the earlier example eight distinct steps were identified from when a user first enters a destination in their browser to when the browser actually connects to the destination site.  Four of the seven steps deal with redirecting, or bouncing your browser from one recursive name server to another, all narrowing in on the desired destination.  In this case the name servers that redirected queries were:
 # Your [[ISP]]’s name server<br>
-# The [[Root Server|root servers]]<br>
+# The root servers<br>
 # The [[TLD]] name servers<br>
 # The name servers of the destination server’s network provider<br>
@@ Line 31: / Line 31: @@
 So while the global [[DNS]] hierarchy is designed for a logical method for navigating the Internet, vulnerabilities exist that can impact your firm’s brand, business stability as well as the global economic presence countries are building by using the Internet.  Having a strong business resiliency plan will help mitigate threats posed to your customers, your company and your country.
+__FORCETOC__
-__NOTOC__
 __NOEDITSECTION__