DNS Security

DNS Security Complete Guide: Attacks and Mitigation Strategies

🎯 What You'll Learn:
Understand major DNS security threats including cache poisoning, NXDOMAIN attacks, query flood attacks, and phantom domain attacks. Learn mitigation strategies including DNSSEC, DNS over HTTPS (DoH), DNS over TLS (DoT), and best practices for securing DNS infrastructure.

DNS Cache Poisoning Attack

DNS cache poisoning attack, which is also known as DNS spoofing attack, is one of the most dangerous DNS security threats.

⚠️ What is DNS Cache Poisoning?

• If you recall from our previous lesson on caching in the name resolution section, caching is used extensively in DNS to save network bandwidth and reduce lookup latency
• The purpose of the DNS cache poisoning attack is to abuse the way DNS caches work by poisoning the resolver's cache with the goal of achieving DNS spoofing
• Name lookups originated from a client are answered by a malicious actor who redirects users to a fraudulent web page

How the Attack Works

• The fraudulent website would typically be a mirror of a legitimate site so that once end users are redirected, they are tricked into taking a specific set of actions engineered by the attacker
• Some of those actions could involve:
  • Presenting authentication prompts, encouraging the victim to supply their credentials
  • Luring the user into downloading files infected with malware
  • Stealing sensitive information like credit card details or personal data
• The impact of this attack can be substantial, since it can lead to:
  • Stolen credentials
  • Data theft
  • Critical data encrypted with ransomware
  • Compromised hosts that become bots as part of a botnet
• If done correctly, not only would the attacker be able to accomplish their aims, but also the end user would remain completely unaware of the fact that they fell victim to this cyber-attack

Four Main Threat Vectors

The DNS cache poisoning attack has four main threat vectors:

1. Man-in-the-Middle (MITM) Attack

🎭 MITM Attack Process:

• The attacker places themselves between the client and the server by using tools such as ARP spoofing tools
• Can modify the MAC addresses in the DNS resolver's ARP table, causing it to think that the attacker's computer belongs to the client
• At the same time, by utilizing the same tool, the client is also tricked into thinking that the system controlled by the attacker is the DNS server
• At the end of this process, the attacker can then use a tool such as DNSspoof to direct all DNS requests to the fake sites designed by the attacker

2. DNS Server Hijacking

• This entails compromising the DNS resolver directly with a goal of injecting false data into its cache
• Achieves DNS spoofing and redirects the client to the attacker's site
• Once the server is compromised, all clients using that resolver are at risk

3. Client Machine Hijacking

• Just like with DNS server hijacking, this vector involves compromising the client directly
• Once the attacker has gained access to the client, they can proceed to injecting false DNS data in the hosts file
• As you remember from the local name resolution section, the hosts file is consulted by the operating system before DNS kicks in
• By poisoning the hosts file, the attacker can accomplish DNS spoofing again without even having to worry about the DNS resolver

4. Birthday Attack

🎲 Birthday Attack Mechanism:

• This is when the attacker tries to get the transaction ID of the client's DNS request
• Once obtained, they can respond to it with a false response of their own
• This poisons the cache of the DNS resolver, which from that point on will be saving the attacker's IP address
• Named after the birthday paradox in probability theory

Mitigation Measures for Cache Poisoning

1. DNSSEC (DNS Security Extensions)

🔐 DNSSEC Overview:

• DNSSEC is short for Domain Name System Security Extensions
• A means of verifying DNS data integrity and origin
• Uses public key signatures to verify and authenticate data, thus preventing forgery
• Downside: When the DNS resolver needs to verify the signature with the authoritative DNS server, the entire process of name resolution slows down
• This is the reason why DNSSEC is still not widely adopted

2. DNS over HTTPS (DoH) and DNS over TLS (DoT)

🔒 DoH and DoT Overview:

• These standards are competing specifications designed to keep DNS requests secure without sacrificing speed like DNSSEC
• Unlike DNSSEC, which verifies the identity of the DNS root service and authoritative name servers in communication with DNS resolvers, DoH and DoT encrypt DNS traffic
• Makes it harder for attackers to tamper with DNS requests and responses while in transit
• Key Difference:
  • DoH: Uses Port 443 (same as HTTPS)
  • DoT: Uses Port 853 (dedicated port)

Security Method	Port	Protection Method	Performance
DNSSEC	53	Public key signatures for authentication	Slower (signature verification)
DoH	443	Encrypts DNS traffic over HTTPS	Faster than DNSSEC
DoT	853	Encrypts DNS traffic over TLS	Faster than DNSSEC

3. Patching DNS Software

• If, for example, you have configured your DNS resolver with BIND, make sure that you're using the latest version
• Keep up to date with all the latest security patches
• Subscribe to security mailing lists for your DNS software
• Regularly check for vulnerabilities and updates

4. Applying Endpoint Security

• Do not forget to harden your client systems by applying appropriate endpoint security
• Reduce the attack surface to prevent client machine hijacking attacks
• Implement host-based firewalls and antivirus software
• Restrict modifications to hosts file

NXDOMAIN Attack

The NXDOMAIN attack is a DNS-based denial of service attack, which aims at disrupting the availability of the DNS server by flooding it with requests for invalid or non-existent records.

⚠️ How NXDOMAIN Attack Works:

• Using a tool, the attacker can generate and transmit large volumes of unique subdomains for each request sent to the DNS resolver
• As a result, the DNS resolver's continued attempts to resolve the fake domains in the attacker's name lookup requests lead to high resource utilization on the DNS resolver itself
• The resolver finds it more difficult to respond to legitimate requests
• Since the records queried by the attacker do not exist, the DNS resolver's cache is being filled up with NXDOMAIN replies, slowing down the service response time for legitimate requests even further
• When the cache gets filled up with NXDOMAIN responses, valid cache entries get pushed out, resulting in further service degradation

Symptoms of NXDOMAIN Attack

• The cache of the DNS server gets filled with NXDOMAIN records
• Resource utilization increases significantly (CPU, memory, network)
• Legitimate requests become difficult to answer by the server
• Response times for valid queries increase dramatically

Mitigation Measures for NXDOMAIN Attack

Mitigation Strategy	Description
Restrict DNS Queries	Limit DNS queries to trusted clients only using ACLs
Block Source IPs	Block the offending source IP addresses at firewall level
Flush Cache	Flush the cache on the DNS resolver to remove NXDOMAIN entries
Specialized Solutions	Use dedicated DDoS protection solutions by specialized vendors

DNS Query Flood Attack

The DNS Query Flood attack is another DNS-based denial of service attack, which aims at disrupting the availability of the DNS server by flooding it with name requests.

🌊 Query Flood Attack Characteristics:

• Attacker sends massive volumes of legitimate-looking DNS queries
• Unlike NXDOMAIN, queries may be for real domains
• Overwhelms the DNS server's capacity to respond
• Exhausts server resources (bandwidth, CPU, memory)
• Legitimate users cannot get their queries answered

Mitigation Measures for Query Flood Attack

Mitigation Strategy	Description
Restrict DNS Queries	Limit DNS queries to trusted clients only
Block Source IPs	Block the offending source IP addresses
Rate Limiting	Implement rate limiting to control queries per source
Cache-Only DNS Server	Deploy a cache-only DNS server to reduce authoritative server load
Overprovision Bandwidth	Overprovision bandwidth on the name server to absorb attack traffic

Phantom Domain Attack

But what about attacks that take the form of requests against real domains whose name servers simply do not respond? Well, there is just such an attack that is known as phantom domain attack.

👻 How Phantom Domain Attack Works:

• In a phantom domain attack, the malicious actor lays the groundwork by first configuring several domains
• Then they configure the authoritative name servers of those domains to either respond to requests very slowly or not respond at all
• Once they have done this work, the attacker then proceeds to sending a huge number of queries to the victim DNS resolver
• The resolver must spend time and resources doing the recursion against the records of the phantom domains, whose name servers will simply not respond
• The phantom domain attack is yet another type of DNS-based denial of service attack, since its goal is to exhaust the resources of the DNS resolver and disrupt its availability for legitimate users

Attack Impact

• DNS resolver resources tied up waiting for responses that never come
• Timeouts consume CPU cycles and memory
• Legitimate queries experience delays
• Resolver queue fills up, preventing new queries from being processed

Mitigation Measures for Phantom Domain Attack

Mitigation Strategy	Description
Rate Limiting	Implement rate limiting to control query volume
Restrict Recursive Queries	Restricting recursive queries per server and per zone
Specialized Vendor Solutions	Use dedicated solutions by specialized vendors (e.g., F5 BIG-IP is designed to time out connections and release requests in the queue so the resolver doesn't need to wait for responses that will never come)

🎓 Key Takeaways:

• DNS Cache Poisoning: Poisons resolver cache to redirect users to malicious sites
  • Four vectors: MITM, DNS server hijacking, client hijacking, birthday attack
  • Mitigation: DNSSEC, DoH/DoT, patching, endpoint security
• NXDOMAIN Attack: Floods DNS with queries for non-existent domains
  • Fills cache with NXDOMAIN responses
  • Mitigation: Restrict queries, block IPs, flush cache, specialized solutions
• DNS Query Flood: Overwhelms DNS server with massive query volume
  • Exhausts bandwidth and server resources
  • Mitigation: Rate limiting, cache-only servers, overprovision bandwidth
• Phantom Domain Attack: Queries domains with non-responsive name servers
  • Ties up resolver resources waiting for responses
  • Mitigation: Rate limiting, restrict recursion, timeout management
• Security Technologies:
  • DNSSEC uses signatures (slower but authenticates)
  • DoH uses port 443 (encrypted, faster)
  • DoT uses port 853 (encrypted, faster)
• All DNS DoS attacks aim to exhaust resources and disrupt availability
• Layered defense approach recommended: combine multiple mitigation strategies

📚 Practice Exercises

1. Research and explain the difference between DNS cache poisoning and DNS hijacking
2. Set up a test environment and demonstrate how the hosts file can be used for local DNS poisoning
3. Compare DNSSEC, DoH, and DoT - which would you recommend for a corporate environment and why?
4. Analyze DNS logs to identify potential NXDOMAIN attack patterns
5. Calculate the impact: If a DNS server can handle 10,000 queries/second, how many attacking hosts sending 100 queries/second each would it take to overwhelm it?
6. Design a multi-layered DNS security architecture for a large organization
7. Explain why DoH uses port 443 instead of a dedicated port like DoT
8. Create an incident response plan for a detected DNS cache poisoning attack
9. Research the birthday attack - why is it called that and how does transaction ID randomization help?
10. Compare the resource consumption of NXDOMAIN attacks vs Phantom Domain attacks

🛡️ Security Best Practices Summary:

• Prevention: Implement DNSSEC, DoH, or DoT for secure DNS communication
• Access Control: Restrict DNS queries to trusted clients using ACLs
• Rate Limiting: Control query volume per source to prevent flooding
• Monitoring: Continuously monitor for unusual query patterns and NXDOMAIN spikes
• Patching: Keep DNS software up to date with latest security patches
• Redundancy: Deploy multiple DNS servers in different locations
• Caching Strategy: Use cache-only servers to reduce authoritative server load
• Endpoint Security: Harden client systems to prevent hosts file poisoning
• Bandwidth: Overprovision network capacity to absorb attack traffic
• Specialized Solutions: Consider dedicated DNS security appliances for large deployments