Instructor: In this lesson,
we will learn about DNS security.
DNS security is used to protect the system
from attacks and misconfigurations
that could disrupt or manipulate network traffic.
DNS security concepts
include the Domain Name Security Extensions or DNSSEC,
zone transfers, DNS poisoning, and sinkholing.
Domain Name System Security Extensions
add a layer of security to the name resolution process
by digitally signing DNS data
to ensure its integrity and authenticity.
Next, zone transfers are a normal and expected mechanism
used to replicate DNS databases across DNS servers,
but if misconfigured, the process can be attacked.
Next, DNS poisoning or cache poisoning
is an attack where false DNS data
is injected into a DNS resolver's cache.
And finally, sinkholing is a defensive technique
that redirects malicious traffic,
such as that resulting from DNS poisoning,
to a safe destination for analysis.
Let's learn more about DNS Security Extensions or DNSSEC,
zone transfers, DNS poisoning, and DNS sinkholing.
Then we'll do a quick demo
showing an act of directory misconfiguration
that could lead to a zone transfer attack.
First we have DNS Security Extensions,
but before diving into DNS Security Extensions or DNSSEC,
let's review how DNS works.
Whenever you try to visit a website like diontraining.com,
your computer needs to figure out
where that website is located.
However, computers do not understand names
the way people do.
Instead, they use and understand IP addresses,
like 66.23.47.12.
The Domain Name System or DNS
is the service that translates human-friendly domain names
into machine-friendly IP addresses.
This process happens behind the scenes
every time you click on a link or type in a URL.
The problem with DNS is that it was created in the 1980s
when fewer people used the internet
and security was less of a concern.
As a result, DNS lacks built-in security features.
When your computer tries to resolve a domain name,
it goes through a series of steps,
starting at the root servers,
then the top-level domain servers like .com or .org,
then to domain servers like diontraining.com,
and so on until it finds the correct IP address.
This is called iterative DNS resolution.
Unfortunately, there is no way to verify
whether the response your computer finally gets
is actually from the correct source.
Attackers can take advantage of this vulnerability
by sending fake responses,
which then gets stored or cached in your DNS server
as if they were legitimate.
This is known as DNS cache poisoning,
and it could direct a victim to a malicious website
without the victim even realizing they are being redirected.
To address this, DNS Security Extensions or DNSSEC
were introduced in the 1990s.
DNSSEC uses digital signatures
and public key cryptography
to ensure that DNS data is authentic.
To do this, each DNS zone is given
a public and private key.
The zone owner uses the private key
to digitally sign the DNS data,
ensuring that it's from the correct source.
The public key, which is available to everyone,
is then used to verify the data.
This process prevents attackers
from poisoning the cache with false data
because the system checks the digital signature
before accepting any DNS responses.
However, both the DNS zone owner and the resolvers,
which are the two systems that request DNS data,
need to be configured to support DNSSEC.
So, if you manage a DNS server,
enabling DNSSEC can protect your network
from cache poisoning
and ensure the accuracy of your DNS records.
Second we have zone transfers.
A DNS zone is a portion of the DNS namespace
that a specific DNS server or a group of servers manages.
Zone transfers are the normal process
by which DNS servers share and synchronize
this zone information amongst themselves.
For instance, if one authoritative DNS server goes down,
another authoritative DNS server can take over
because it already has a copy
of the same DNS zone data.
This makes zone transfers an essential part of DNS,
ensuring that multiple servers have up-to-date information,
which improves reliability and redundancy.
However, if zone transfers are not properly secured,
they can be exploited.
An attacker could initiate an unauthorized zone transfer
and gain access to all the DNS records in a zone.
This could reveal critical details
about the network's infrastructure,
including system names and IP addresses,
making it easier for the attacker
to target those systems.
So, to prevent this,
administrators must secure zone transfers
by limiting which DNS servers
are authorized to request a zone transfer
and using methods like transaction signatures or TSIGs
to authenticate the transfer.
Without proper security,
zone transfers can become a significant vulnerability,
exposing sensitive information
and increasing the risk of an attack.
Third we have a DNS poisoning.
DNS cache poisoning occurs with an attacker
sends fake or malicious DNS responses,
which are then accepted as valid by the DNS resolver.
Once the fake response is stored
or cached on the DNS server,
anyone who requests that domain
will be sent to the wrong IP address,
often controlled by an attacker.
This can lead users to malicious websites
that appear legitimate,
but are designed to steal information or install malware.
Attackers use several techniques to poison a DNS cache.
One common method is DNS response spoofing.
Here, the attacker floods the DNS server
with fake responses,
hoping one matches a legitimate request.
If the DNS server accepts the malicious response,
it will store the incorrect information
and return it to anyone who asks for that domain.
Another method is exploiting vulnerabilities
in outdated or poorly-configured DNS servers,
which may accept data without verifying its authenticity.
Once DNS poisoning occurs,
it can be hard to detect.
Users might not realize they are on a fake website
because everything will look normal.
This makes DNS poisoning a dangerous attack.
To defend against it,
DNS servers should implement security measures like DNSSEC,
which verifies DNS responses with digital signatures.
Additionally, keeping DNS servers updated and patched
helps close vulnerabilities that attackers might exploit.
Fourth and last, we have sinkholing.
DNS sinkholing is a technique used by security professionals
to divert malicious traffic away from its intended target
and direct it to a controlled environment
called a sinkhole server.
So, instead of letting harmful traffic
reach its destination,
like an external command and control server,
the DNS server redirects it
to a safe location called a sinkhole.
This is especially useful for stopping malware like botnets
from communicating for direction
or spreading their malicious code.
The DNS sinkholing process starts when the DNS server
identifies a malicious domain or IP address.
The server is then configured
to reroute any traffic headed to that domain
into the sinkhole instead.
For instance, if malware on an infected device
tries to connect to a command and control server
to receive further instructions,
the DNS server intercepts the request
and directs it to the sinkhole instead.
The sinkhole server either drops the traffic
or allows security analysts to monitor it
in a safe and controlled environment,
giving them insight into how the malware is operating.
DNS sinkholing is an effective strategy
for stopping further damage after a threat is detected.
It cuts off communication
between infected devices and their controllers,
which helps stop the spread of malware and maliciousness.
For sinkholing to work properly, however,
the DNS server must be regularly updated
with the latest threat intelligence
to ensure it knows which domains or IP addresses
are linked with malicious activity.
Additionally, sinkhole servers must be secured
to prevent them from becoming a new target for attackers.
Now, let's take a look at a demonstration
that highlights a misconfiguration
that could lead to a zone transfer attack
in Microsoft Active Directory.
In this demonstration,
I have two virtual machines
running on the same virtual network.
On the left-hand side,
I have a Parrot Security Operating System operating.
On the right-hand side of the screen,
I have Windows Server 2022 operating
with a DNS service configured.
Let's take a closer look at the DNS records
by going to Tools then DNS.
Here in the DNS Manager,
you can see that I have a forward lookup zone configured
called myZone.com.
And in this zone,
I've configured a few DNS records.
Let's prove that we can query for those records
from the Parrot Security Operating System.
We'll use the dig command
and just look for an A record for myZone.com.
And we've got an answer.
We can see that the IP address
that was returned for myZone.com is 192.168.56.111.
We could even test for the mail exchange record
by just changing our dig request.
And you can see that there is a myZoneEmailServer01.com
that is configured in these DNS records.
If we wanted to try to grab all of the records at one time,
we could attempt a zone transfer.
That would be done using the axfr command in dig.
Let's go ahead and try it.
We can see that that transfer failed
because of the configuration on Windows Server 2022,
but what we are going to find
is that we're only one selection away
from allowing zone transfers to anyone who requests them
on this Windows Server 2022 configuration.
So, I'll go to myZone.com and I'll select Properties.
In Properties, I'm going to go to the Zone Transfers tab,
and you can see that zone transfers are allowed,
and again, they are a totally normal part
of operations within a domain.
And you can see we are currently configured
to allow zone transfers only to servers
listed in the Name Servers tab,
and there is only one.
But we are going to insert a misconfiguration
and we're going to allow zone transfers to any server.
So, one select of the radio button to any server
and one click of the Apply,
now let's try that zone transfer
from Parrot Security again.
And you can see that we were able to grab
all of the records from the DNS server at myZone.com
with our zone transfer request.
So, as you can see,
the zone transfer here to a simulated unauthorized device,
the Parrot Security machine, was permitted,
and we were only a single radio button selection and apply
from this misconfiguration
that could lead to this significant vulnerability.
So, remember, DNS security is essential
to protect networks from attacks and misconfigurations
that could compromise network traffic.
Key concepts in DNS security
include Domain Name System Security Extensions or DNSSEC,
zone transfers, DNS poisoning, and DNS sinkholing.
DNSSEC adds a layer of security
by using digital signatures
to verify the authenticity of DNS data,
ensuring that users are directed
to the correct IP addresses.
Next, zone transfers,
which allow DNS servers to synchronize data,
must be secured to prevent attackers
from gaining unauthorized access to sensitive DNS records.
Next, DNS poisoning or cache poisoning
occurs when attackers insert false DNS data
into a server's cache,
redirecting users to malicious sites.
And finally, DNS sinkholing is a defensive technique
that redirects malicious traffic to a safe server,
preventing malware from reaching its intended destination.