#dnsattacks — Public Fediverse posts

CoreDNS Vulnerability Let Attackers Pin DNS Cache And Deny Service Updates https://cybersecuritynews.com/coredns-vulnerability/ #CyberSecurityNews #VulnerabilityNews #cybersecuritynews #Vulnerability #cybersecurity #vulnerability #DNSAttacks

Hackers Can Hide Images in Text Data and Embeds Directly into DNS TXT Records https://cybersecuritynews.com/hiding-images-in-dns-txt-records/ #CyberSecurityNews #cybersecuritynews #CyberSecurity #cybersecurity #DNSAttacks

Types of DNS Attacks You Should Know ⚔️🌐🔍

The Domain Name System (DNS) is a core part of how the internet works — and it’s also a prime target for attackers. Understanding DNS attack types is essential for defending network infrastructure.

🛠️ Common DNS Attack Types:

1. DNS Spoofing / Cache Poisoning
→ Injects false DNS data into a resolver's cache to redirect users to malicious sites.

2. DNS Tunneling
→ Encodes data into DNS queries/responses to exfiltrate data or establish covert C2 channels.

3. DNS Amplification (DDoS)
→ Exploits open DNS resolvers to flood a target with amplified traffic.

4. NXDOMAIN Attack
→ Overloads DNS servers with queries for nonexistent domains, degrading performance.

5. Domain Hijacking
→ Unauthorized changes to DNS records or domain ownership to take control of web traffic.

6. Typosquatting / Homograph Attacks
→ Uses lookalike domains to trick users into visiting malicious sites.

7. Subdomain Takeover
→ Targets misconfigured DNS entries pointing to expired resources (e.g., GitHub Pages, AWS buckets).

Why it matters:
DNS is often overlooked in security strategies, but it’s a critical attack surface. Proper monitoring, DNSSEC, and logging can reduce risk.

Disclaimer: This content is for educational and awareness purposes only.

#DNSAttacks #CyberSecurity #InfoSec #NetworkSecurity #EducationOnly #DNSHijacking #Spoofing #RedTeamAwareness #BlueTeamDefense

Types of DNS Attacks You Should Know ⚔️🌐🔍

The Domain Name System (DNS) is a core part of how the internet works — and it’s also a prime target for attackers. Understanding DNS attack types is essential for defending network infrastructure.

🛠️ Common DNS Attack Types:

1. DNS Spoofing / Cache Poisoning
→ Injects false DNS data into a resolver's cache to redirect users to malicious sites.

2. DNS Tunneling
→ Encodes data into DNS queries/responses to exfiltrate data or establish covert C2 channels.

3. DNS Amplification (DDoS)
→ Exploits open DNS resolvers to flood a target with amplified traffic.

4. NXDOMAIN Attack
→ Overloads DNS servers with queries for nonexistent domains, degrading performance.

5. Domain Hijacking
→ Unauthorized changes to DNS records or domain ownership to take control of web traffic.

6. Typosquatting / Homograph Attacks
→ Uses lookalike domains to trick users into visiting malicious sites.

7. Subdomain Takeover
→ Targets misconfigured DNS entries pointing to expired resources (e.g., GitHub Pages, AWS buckets).

Why it matters:
DNS is often overlooked in security strategies, but it’s a critical attack surface. Proper monitoring, DNSSEC, and logging can reduce risk.

Disclaimer: This content is for educational and awareness purposes only.

#DNSAttacks #CyberSecurity #InfoSec #NetworkSecurity #EducationOnly #DNSHijacking #Spoofing #RedTeamAwareness #BlueTeamDefense

Types of DNS Attacks You Should Know ⚔️🌐🔍

The Domain Name System (DNS) is a core part of how the internet works — and it’s also a prime target for attackers. Understanding DNS attack types is essential for defending network infrastructure.

🛠️ Common DNS Attack Types:

1. DNS Spoofing / Cache Poisoning
→ Injects false DNS data into a resolver's cache to redirect users to malicious sites.

2. DNS Tunneling
→ Encodes data into DNS queries/responses to exfiltrate data or establish covert C2 channels.

3. DNS Amplification (DDoS)
→ Exploits open DNS resolvers to flood a target with amplified traffic.

4. NXDOMAIN Attack
→ Overloads DNS servers with queries for nonexistent domains, degrading performance.

5. Domain Hijacking
→ Unauthorized changes to DNS records or domain ownership to take control of web traffic.

6. Typosquatting / Homograph Attacks
→ Uses lookalike domains to trick users into visiting malicious sites.

7. Subdomain Takeover
→ Targets misconfigured DNS entries pointing to expired resources (e.g., GitHub Pages, AWS buckets).

Why it matters:
DNS is often overlooked in security strategies, but it’s a critical attack surface. Proper monitoring, DNSSEC, and logging can reduce risk.

Disclaimer: This content is for educational and awareness purposes only.

#DNSAttacks #CyberSecurity #InfoSec #NetworkSecurity #EducationOnly #DNSHijacking #Spoofing #RedTeamAwareness #BlueTeamDefense

Types of DNS Attacks You Should Know ⚔️🌐🔍

The Domain Name System (DNS) is a core part of how the internet works — and it’s also a prime target for attackers. Understanding DNS attack types is essential for defending network infrastructure.

🛠️ Common DNS Attack Types:

1. DNS Spoofing / Cache Poisoning
→ Injects false DNS data into a resolver's cache to redirect users to malicious sites.

2. DNS Tunneling
→ Encodes data into DNS queries/responses to exfiltrate data or establish covert C2 channels.

3. DNS Amplification (DDoS)
→ Exploits open DNS resolvers to flood a target with amplified traffic.

4. NXDOMAIN Attack
→ Overloads DNS servers with queries for nonexistent domains, degrading performance.

5. Domain Hijacking
→ Unauthorized changes to DNS records or domain ownership to take control of web traffic.

6. Typosquatting / Homograph Attacks
→ Uses lookalike domains to trick users into visiting malicious sites.

7. Subdomain Takeover
→ Targets misconfigured DNS entries pointing to expired resources (e.g., GitHub Pages, AWS buckets).

Why it matters:
DNS is often overlooked in security strategies, but it’s a critical attack surface. Proper monitoring, DNSSEC, and logging can reduce risk.

Disclaimer: This content is for educational and awareness purposes only.

#DNSAttacks #CyberSecurity #InfoSec #NetworkSecurity #EducationOnly #DNSHijacking #Spoofing #RedTeamAwareness #BlueTeamDefense

Types of DNS Attacks You Should Know ⚔️🌐🔍

The Domain Name System (DNS) is a core part of how the internet works — and it’s also a prime target for attackers. Understanding DNS attack types is essential for defending network infrastructure.

🛠️ Common DNS Attack Types:

1. DNS Spoofing / Cache Poisoning
→ Injects false DNS data into a resolver's cache to redirect users to malicious sites.

2. DNS Tunneling
→ Encodes data into DNS queries/responses to exfiltrate data or establish covert C2 channels.

3. DNS Amplification (DDoS)
→ Exploits open DNS resolvers to flood a target with amplified traffic.

4. NXDOMAIN Attack
→ Overloads DNS servers with queries for nonexistent domains, degrading performance.

5. Domain Hijacking
→ Unauthorized changes to DNS records or domain ownership to take control of web traffic.

6. Typosquatting / Homograph Attacks
→ Uses lookalike domains to trick users into visiting malicious sites.

7. Subdomain Takeover
→ Targets misconfigured DNS entries pointing to expired resources (e.g., GitHub Pages, AWS buckets).

Why it matters:
DNS is often overlooked in security strategies, but it’s a critical attack surface. Proper monitoring, DNSSEC, and logging can reduce risk.

Disclaimer: This content is for educational and awareness purposes only.

#DNSAttacks #CyberSecurity #InfoSec #NetworkSecurity #EducationOnly #DNSHijacking #Spoofing #RedTeamAwareness #BlueTeamDefense

BIND DNS Vulnerability Let Attackers Crash DNS Servers With Malicious Packet https://cybersecuritynews.com/bind-dns-vulnerability/ #CyberSecurityNews #cybersecuritynews #CyberSecurity #Vulnerability #cybersecurity #vulnerability #DNSAttacks

Hackers Exploiting DNS Tunneling Service To Bypass Network Firewalls https://cybersecuritynews.com/hackers-exploiting-dns-tunneling/ #THREATINTELLIGENCE #CyberSecurityNews #NetworkSecurity #cybersecurity #DNSTunneling #CyberAttack #DNSAttacks

DNSSEC+ – Secure Model That Addresses Security And Downsides Of DNSSEC https://cybersecuritynews.com/dnssec-enhanced-security-model/ #CyberSecurityResearch #CyberSecurityNews #cybersecuritynews #NetworkSecurity #Networksecurity #cybersecurity #DNSAttacks #DNSSEC+

Sitting Ducks DNS Attack Hijack 35,000 Domains https://cybersecuritynews.com/sitting-ducks/ #CyberSecurityNews #DomainHijacking #CyberAttack #DNSSecurity #DNSAttacks

Sitting Ducks DNS Attack Hijack 35,000 Domains
#cybersecurity #CyberAttack #DNSAttacks https://cybersecuritynews.com/sitting-ducks/

»#SittingDucks #DNSattacks let #hackers hijack over 35,000 #domains: criminals exploit #configurationshortcomings at the #registrarlevel and insufficient #ownershipverification at #DNSproviders.« https://www.bleepingcomputer.com/news/security/sitting-ducks-dns-attacks-let-hackers-hijack-over-35-000-domains/?eicker.news #tech #media

@jscalzi : please stop using a http links if websites support https.

By specifying https://vote.org (or https://vote.org/ which gives the same result) in a link, or by typing https://vote.org in the address bar of your browser, there are three possibilities:

1) the browser connects to the _real_ vote.org website;

2) the browser displays a certificate error (never continue in such a case);

3) extemely unlikely (see [1]): the browser connects to a fake website that managed to obtain a valid certificate for the vote.org domain name.

(Note: I used the Unicode '/' character instead of the regular slash char '/' to prevent Mastodon from hiding the protocol).

By default, _none_ of the popular web browsers prevents active (i.e. not passive) criminals from successfully conducting Man-in-the-Middle attacks - if the first connection-attempt uses http.

Most browsers _may_ TRY https first, but an attacker can block that request, forcing the browser to downgrade to http (if the user explicitly requested https, such a downgrade to http will _not_ happen).

Such attacks can be conducted in various ways, such as by using an "evil twin" WiFi access point (https://www.bleepingcomputer.com/news/security/australian-charged-for-evil-twin-wifi-attack-on-plane/) or by manipulating DNS replies to browsers.

Note: the domain "vote.org" is currently _not_ listed in the HSTS preload list (apparently it was removed because of stupidities): https://hstspreload.org/?domain=vote.org (being listed would _force_ browsers to use https, even if "the user" requested http by tapping on such a link).

See also the unnecessarily poor results in https://internet.nl/site/vote.org/2883671/

Unfortunately also @BleepingComputer regularly uses unnecessary http links in their articles.

[1] More info: https://infosec.exchange/@Bitwiper/112779974228111155

@adamshostack

#http #https #httpsvshttp#httpvshttps #AitM #MitM #EvilTwin #DNS #DNSAttacks #DV #DomainValidated #DomainValidation #Certificates #TLSCertificates #httpsCertificates #httpsServerCertificates #ServerCertificates #Authentication #Impersonation

@jscalzi : please stop using a http links if websites support https.

By specifying https://vote.org (or https://vote.org/ which gives the same result) in a link, or by typing https://vote.org in the address bar of your browser, there are three possibilities:

1) the browser connects to the _real_ vote.org website;

2) the browser displays a certificate error (never continue in such a case);

3) extemely unlikely (see [1]): the browser connects to a fake website that managed to obtain a valid certificate for the vote.org domain name.

(Note: I used the Unicode '/' character instead of the regular slash char '/' to prevent Mastodon from hiding the protocol).

By default, _none_ of the popular web browsers prevents active (i.e. not passive) criminals from successfully conducting Man-in-the-Middle attacks - if the first connection-attempt uses http.

Most browsers _may_ TRY https first, but an attacker can block that request, forcing the browser to downgrade to http (if the user explicitly requested https, such a downgrade to http will _not_ happen).

Such attacks can be conducted in various ways, such as by using an "evil twin" WiFi access point (https://www.bleepingcomputer.com/news/security/australian-charged-for-evil-twin-wifi-attack-on-plane/) or by manipulating DNS replies to browsers.

Note: the domain "vote.org" is currently _not_ listed in the HSTS preload list (apparently it was removed because of stupidities): https://hstspreload.org/?domain=vote.org (being listed would _force_ browsers to use https, even if "the user" requested http by tapping on such a link).

See also the unnecessarily poor results in https://internet.nl/site/vote.org/2883671/

Unfortunately also @BleepingComputer regularly uses unnecessary http links in their articles.

[1] More info: https://infosec.exchange/@Bitwiper/112779974228111155

@adamshostack

#http #https #httpsvshttp#httpvshttps #AitM #MitM #EvilTwin #DNS #DNSAttacks #DV #DomainValidated #DomainValidation #Certificates #TLSCertificates #httpsCertificates #httpsServerCertificates #ServerCertificates #Authentication #Impersonation

@jscalzi : please stop using a http links if websites support https.

By specifying https://vote.org (or https://vote.org/ which gives the same result) in a link, or by typing https://vote.org in the address bar of your browser, there are three possibilities:

1) the browser connects to the _real_ vote.org website;

2) the browser displays a certificate error (never continue in such a case);

3) extemely unlikely (see [1]): the browser connects to a fake website that managed to obtain a valid certificate for the vote.org domain name.

(Note: I used the Unicode '/' character instead of the regular slash char '/' to prevent Mastodon from hiding the protocol).

By default, _none_ of the popular web browsers prevents active (i.e. not passive) criminals from successfully conducting Man-in-the-Middle attacks - if the first connection-attempt uses http.

Most browsers _may_ TRY https first, but an attacker can block that request, forcing the browser to downgrade to http (if the user explicitly requested https, such a downgrade to http will _not_ happen).

Such attacks can be conducted in various ways, such as by using an "evil twin" WiFi access point (https://www.bleepingcomputer.com/news/security/australian-charged-for-evil-twin-wifi-attack-on-plane/) or by manipulating DNS replies to browsers.

Note: the domain "vote.org" is currently _not_ listed in the HSTS preload list (apparently it was removed because of stupidities): https://hstspreload.org/?domain=vote.org (being listed would _force_ browsers to use https, even if "the user" requested http by tapping on such a link).

See also the unnecessarily poor results in https://internet.nl/site/vote.org/2883671/

Unfortunately also @BleepingComputer regularly uses unnecessary http links in their articles.

[1] More info: https://infosec.exchange/@Bitwiper/112779974228111155

@adamshostack

#http #https #httpsvshttp#httpvshttps #AitM #MitM #EvilTwin #DNS #DNSAttacks #DV #DomainValidated #DomainValidation #Certificates #TLSCertificates #httpsCertificates #httpsServerCertificates #ServerCertificates #Authentication #Impersonation