Topics In Demand
Notification
New

No notification found.

What is DNS Security and Why is it Important?
What is DNS Security and Why is it Important?

7

0

Any device connected to the internet has an address similar to how each house has one. These are called Domain names. The Domain Name System translates the domain names into IP addresses and also eliminates the need for manual storage of these addresses. Ever since created in 1983, it has become an essential service on the internet. However, being a popular service comes with its drawbacks.

In the age of DNS’s development, the intention of security was lacking. But with time several security measures develop. And nowadays you can prevent common attacks like content scraping and MITM, with proper measures.

Recently, LinkedIn has been reported to be a victim of data scraping of 500 million accounts. The information contained names, email addresses, phone numbers along with other information. According to cybernews, the data from leaked files can be used by threat actors against LinkedIn users by:

- Carrying out targeted phishing attacks

- Spamming 

- Brute-forcing the passwords of leaked profiles and email addresses

What Is DNS And Its Purpose?

The Domain Name System or DNS is quite what it sounds like. A collection of domain names in terms of IP Addresses. Unlike a physical address book, a DNS server is more reliant and convenient. It converts a hostname into an IP address and stores it.  Each website receives a unique IP address. It can be requested through the DNS server every time one types in the domain name.

Thus, rather than looking for IP information manually, DNS has made it accessible to people within split seconds.

DNS came to life in the 1980s. The security of the service was not a major concern at that time. As a result, when someone requests a web address the DNS resolver does not have the means to verify the IP. And this leads to fake addresses since the source IP address can be forged by hackers.

What are the major attacks against DNS?

As times have progressed, more threats have emerged in the cyber world. DNS can be said to have been made in a more peaceful time. Consequently, several aspects need attention when considering the security of DNS service. One needs to guard against these types of attacks:

  • Content Scraping

A method that involves bots to explore networks and gather as much data from them as possible. You might have experienced this uncomfortable feeling in classroom examinations when a classmate tries to copy everything you have written. If the teacher figures out they’re the same answers you both get marks deducted.

Copied content can be flagged and your website could get taken down. It can also lead to traffic redirection towards the copied web page.

There are good bots as well though, as used by search engines. DNS firewalls can differentiate between their functions and allow good bots to access your page. Content scraping prevention is one of the vital steps to a secure network.

  • DDoS

A distributed-denial-of-service attack or DDOS attack aims to disrupt the traffic of its target network. The attacker floods the network with fake traffic using bots which results in a time-out. As the DNS server cannot handle traffic over a certain limit.

For this attack, multiple computers increase efficiency. They’re usually ones that have been compromised earlier on but remain hidden to their users. Some viruses can allow hackers to take control of one’s computer remotely. Afterward, through multiple computers, one can flood a website with fake traffic.

Some DDOS attacks have lasted for weeks. Thus, they cause major losses for companies.

  • DNS Spoofing

This attack often leads a user to a replicated website of the original by introducing forged DNS data into a DNS resolver’s cache. The replicated website is usually put together by content scrapers and looks like the original website. The attacker gathers login information which can give rise to further attacks on the users. The websites are also ways to spread malware.

  • DNS Hijacking

This attack is also known as DNS redirection where the attacker messes with the DNS resolver to lead the user to a malicious website. This can be achieved through some malware in the user’s computer, modifying the behavior of a DNS server, etc.

When you try to access a website you are redirected to a fake one. It contributes to the revenue of the malicious website and also provides sensitive information to the attacker, such as login id and other credentials entered on the website.

  • Man-In-The-Middle Attacks

This type of threat is one where an attacker inserts itself into a conversation as a hidden third party. This usually happens on public wifi networks that appear trustworthy. Once connected to such a network the attacker can obtain information of any activity conducted through it. They can steal your passwords, hijack emails, credit card information, etc. Other types of Man-In-The-Middle attacks may involve impersonating another network/ website/ shop, and receive payment instead of your actual seller.

What is DNS security?

As a consequence of a DNS attack, a network can be left insecure. Like a wound left open. Thus DNS security is a vital step to take along with measures like email security, antivirus, vulnerability scans, etc.

As explored earlier, there are several threats to the DNS server. Most likely, if you’re a user, you end up on the website you desire. However, if the website is compromised you may end up on a page that is luring you to give your information.  A secure DNS network prevents these types of dangers.

As a merchant, you may be at risk of losing clients and getting content scraped with insecure DNS.

Three Ways to enhance DNS security

There are several ways a hacker can manipulate DNS for their benefit. From DDOS attacks to content scraping. But there are also measures to ensure your network’s safety. Some basic measures are as follows:

1. DNS Security Extensions

DNSSEC provides means of authentication DNS inherently lacks. DNSSEC uses digital signatures using cryptography. Through checking this signature A DNSSEC resolver verifies if the request comes from a valid server. It is similar to a security certificate. If it is missing then you can take steps to block that server request.

2. DNS Filtering

A DNS filter can quite literally filter out known malicious IP addresses and block their request. This can prevent attacks like DDOS and block content scrapers from accessing your data. The process simply adds one more step to DNS resolution. Before the request is completed, a DNS filter checks the request against its data of bad requests. Thus, attackers are prevented from entering your server.

3. DNS Activity Monitoring

By monitoring your traffic logs you can predict malicious activity on your server. An unusual surge in traffic can suggest bad bot activity. This can stop your real users from accessing your website, while content scraping bots or bots for DDoS attacks do their business.

Running regular web scans and security audits can keep things running smoothly for your network. These can provide you information about closing unneeded ports and filtering traffic.

It Is A Compliment

Found your content scraped onto another website? People say imitation is the best flattery. For such attacks, it is usually the good and popular content that content scrapers search for. The intention is not only for popularity though, as it may contribute to their revenue. Your content also becomes a bait to malicious websites. So even if replication is flattery you should do your best to avoid it happening to you.

Make use of good habits such as installing a web firewall, enable two-factor authentication for passwords, checking your emails for data breaches, and keeping up to date with security measures.

 

 


That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.


images
Kanishk Tagade
Marketing Manager

Kanishk Tagade is a Marketing Manager at Astra Security. Having a hawk-eyed view on the cybersecurity threat landscape, market-shifts, and hacktivism activities, Kanishk is a community member of the Nasscom and corporate contributor at many technology magazines and security awareness platforms. Editor-in-Chief at "QuickCyber.news", his work is published in more than 50+ news platforms. He is also a social micro-influencer for the latest cybersecurity defense mechanisms, Digital Transformation, Machine Learning, AI and IoT products.

© Copyright nasscom. All Rights Reserved.