The Domain Name System (DNS) is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It associates various information with domain names assigned to each of the participating entities.

Domain Name System) The Internet’s system for converting alphabetic names into numeric IP addresses. For example, when a Web address (URL) is typed into a browser, DNS servers return the IP address of the Web server associated with that name.

DNS is the abbreviation for Domain Name System. The Domain Name System converts domain names, which can be read by humans, into IP addresses, which in turn can be read by machines. This makes the DNS the “telephone book of the internet” because it is a directory that enables users to access the IP addresses associated with specific addresses in their browsers.

The 3 types of DNS servers and how they work

DNS is a core internet technology, instrumental in mapping human-readable domains into corresponding IP addresses. Learn about the three DNS server types and their roles in the internet.

The three DNS server types server are the following:

1. DNS stub resolver server
2. DNS recursive resolver server
3. DNS authoritative server

Figure 1 below illustrates the three different types of DNS server.

A stub resolver is a software component normally found in endpoint hosts that generates DNS queries when application programs running on desktop computers or mobile devices need to resolve DNS domain names. DNS queries issued by stub resolvers are typically sent to a DNS recursive resolver; the resolver will perform as many queries as necessary to obtain the response to the original query and then send the response back to the stub resolver.

The recursive resolver may reside in a home router, be hosted by an internet service provider or be provided by a third party, such as Google’s Public DNS recursive resolver at 8.8.8.8 or the Cloudflare DNS service at 1.1.1.1.

Since the DNS operates as a distributed database, different servers are responsible — authoritative in DNS-speak — for different parts of the DNS name space.

Figure 2 illustrates a hypothetical DNS resolution scenario in which an application uses all three types of DNS servers to resolve the domain name www.example.com into an IPv4 address — in other words, a DNS address resource record.

In step 1, the stub resolver at the host sends a DNS query to the recursive resolver. In step 2, the recursive resolver resends the query to one of the DNS authoritative name servers for the root zone. This authoritative name server does not have the response to the query but is able to provide a reference to the authoritative name server for the .com zone. As a result, the recursive resolver resends the query to the authoritative name server for the .com zone.

This process continues until the query is finally resent to an authoritative name server for the www.example.com zone that can provide the answer to the original query — i.e., what are the IP addresses for www.example.com? Finally, in step 8, this response is sent back to the stub resolver.

One thing worth noting is that all these DNS messages are transmitted in the clear, and there is the potential for malicious actors to monitor users’ internet activities. Anyone administering DNS servers should be aware of DNS privacy issues and the ways in which those threats can be mitigated.

How does a DNS query work?

A DNS query is always required when the computer does not have the address information necessary for accessing a web page in its cache and the internet service provider’s preconfigured DNS service is also unable to resolve the name. In detail, a DNS query takes place according to the following pattern:

1. The user enters the URL of a website (e.g., www.google.com) in his or her browser.
2. The resolver sends a query to a DNS root server.
3. The root server tells the resolver the top-level domain under which it can find information for the website. For www.google.com, this is the .com Top Level Domain.
4. The resolver sends a query to the relevant Top Level Domain.
5. The Top Level Domain server returns the relevant name server’s IP address. At this point, the resolver sends a request to the name server.
6. The name server returns the IP address of the relevant domain to the resolver, which passes it on to the browser.
7. The browser then accesses the website by sending an HTTP request to the IP address. The server accessed this way transmits the web page files to the browser so that its content can be parsed and displayed.

What are the risks of the DNS?

The Domain Name System can become a victim of cyberattacks. There are many relevant hazards:

• DDoS attacks on name servers: A Distributed Denial of Service attack (DDoS attack) overloads a server with so many queries that it is no longer accessible or only to a limited extent. Name servers are also victims of these attacks, such as the attack on the DNS infrastructure of the company Dyn in October 2016. Many globally popular websites such as Twitter and PayPal were unavailable for several hours. Redundant infrastructure and appropriate security measures are important means of prevention.
• DNS amplification attacks: In a DNS amplification attack, hackers misuse incorrectly configured name servers to amplify their attacks. This is a specific type of DDoS attack. Attackers take advantage of the fact that many name servers will respond to queries from any clients.
• DNS spoofing: DNS spoofing or cache poisoning introduces corrupt data into the DNS resolver’s cache. As a result, hackers can divert web users to any other website and gain access to their data.

HOW TO PREVENT DNS CACHE POISONING

How To Protect Against DNS Cache Poisoning

One of the tricky aspects of DNS cache poisoning is that it will be extremely difficult to determine whether the DNS responses you receive are legitimate or not. In the case of My Ethereum Wallet, they had very limited means to prevent the situation from occurring, and the issue was ultimately solved by their server providers.

Fortunately, there are still a number of measures that your organization can take to prevent such an attack from happening to you, so you should not be under the impression that DNS cache poisoning is impossible or nearly impossible to prevent.

For example, one thing you should do is have your DNS servers configured by an IT professional to rely very little on relationships with other DNS servers. This makes it much harder for a cyber-criminal to use their DNS server to corrupt their targets, meaning your own DNS server is less likely to be corrupted, and therefore you (and everyone in your organization) are less likely to be redirected to an incorrect website.

You can furthermore have your DNS servers configured to only store data that are related specifically to the requested domain and to limit query responses to only provide information that concerns the requested domain as well. The idea is that the server will be set up so that required services are the only ones permitted to run. By having additional services that are not required to run on your DNS server, you greatly increase the odds of an attack happening.

You should also ensure that the most recent version of the DNS is being utilized. This is because the most recent versions will use security features such as port randomization and transaction IDs that are cryptographically secure to help guard against poisoning attacks.

Another important defense against DNS cache poisoning, as MyEtherWallet advised in an announcement following the attack that occurred back in April 2018, is to look for the company’s name in the address bar (so in their case ‘MyEtherWallet Inc’).

This means the site is using an EV SSL/TLS certificateThis would help prevent people from falling victim to a poisoning attack, because they would make sure not to enter their personal details in to a hacker’s website. Not all companies use EV on their websites, so this isn’t a foolproof measure, but it can be a helpful tool when trying to determine if you’re on the right site.

An SSL/TLS certificate is simply a small data file installed on a web server that can bind the details of your organization to a cryptographic key. After it has been installed, the certificate will activate HTTPS protocol to enable a secure and encrypted connection between a browser and your web server. In the case of EV SSL/TLS Certificates, some of those organization details, including the company name as mentioned above, will be presented directly in the browser UI. 

Conclusion

In summary, DNS cache poisoning is when an attacker exploits a DNS server to send a forged DNS response that will be cached by legitimate servers.

Subsequently, users who visit the corrupted domain will be sent to a new IP address that the hacker has selected, which is usually a malicious phishing website where victims can be manipulated into downloading malware or submitting login or financial details.

Taking the steps above will help defend your organization against DNS cache poisoning attacks.

Drop your comment