DNS DNS Presentation on DNS basics PowerPoint.pptx.pptx

DNS Presentation on DNS basics PowerPoint.pptx

1. DNS Domain Name Server

2. Fully Qualifid Domain Name (FQDN) A fully qualified domain name (FQDN) of a host consists of its host name dotted together with its domain name and any names of subdomains in which the host resides. Example: Mail.yahoo.com. is FQDN

3. DNS Name Space It is a system that can translate a domain name like www.google.com into an IP address. DNS uses a hierarchy of servers in order to determine the IP address of a fully qualified domain name FQDN DNS names are resolved from right to left e.g. . Then com then google then www

4. DNS Name Space  com org net ye my uk google alrazi speedtest usm usm www mail www www eee www ftp cs www Administrator has the control starting from third level domain Root Domain Top Level Domain 2 nd Level Domain 3 rd Level Domain 4 th Level Domain

5. Resolve Example | google.com Root Hint servers knows the IP address of top-level domains like . com .com servers knows the address of domains registered under its domain (e.g. google.com).

6. Recursive vs Iterative DNS Query Recursive DNS query is done between a host and a DNS server. Iterative DNS query is done between DNS servers. The result of recursive DNS query is the corresponding IP address or error message. The result of Iterative DNS query is the FQDN’s IP address or an IP address of a lower level domain name server to query. If DNS recursion is disabled at DNS server, then users won’t be able to query that particular DNS server.

7. Records Most important DNS records A: IPv4 address of the host. AAAA: IPv6 address of the host. CNAME: Alias of one name to another NS: Name server record MX: Mail exchange record. Used to identify the servers mail should be delivered to for a domain. SOA: Start of Authority record contain the administrative information about the zone. PTR: for reverse DNS lookups www.dnsimple.com . 3599 IN CNAME dnsimple.com. dnsimple.com. 59 IN A 104.245.210.170

8. DNS Hijacking Attacker changes target DNS record to point to attacker IP address Causes all site visitors to be directed to attacker's web server Motivation Phishing Revenue through ads, cryptocurrency mining, etc. How do they do it ?

9. DNS Hijacking Hijacked DNS Resolver Malicious Server 1.2.3.4 a.com 1.2.3.4 HTTP Request HTTP Response a.com 1.1.1.1

10. DNS Hijacking Vectors Hijacked recursive DNS resolver (shown previously) Hijacked DNS nameserver Compromised user account at DNS provider Malware changes user's local DNS settings Hijacked router

11. DNS Privacy Queries are in plaintext ISPs have been known to sell this data Pro tip: Consider switching your DNS settings to 1.1.1.1 or another provider with a good privacy policy

12. DNS-over-HTTPS

13. DNS Attacks DNS Flood DNS Amplification DNS tunneling Threat actors abuse the DNS protocol to tunnel malware in this type of DNS attack DNS spoofing A DNS attack where threat actors redirect victims to alternate websites by modifying DNS records DNS spying Intermediaries such as an ISP or coffee shop can spy on a user’s web browsing history because a DNS request has no encryption. However, companies like Firefox are trying to change this with a DNS-over-HTTPS rollout.

14. DNS Amplification DNS Request with spoofed IP address of PC1 PC1 Large DNS Response Packet

15. DNS Flooding

16. Exercise What is the role of DNS server How DNS server resolve names Explain records