How does DNS works?

 

 

  1. DNS Client send DNS Request of the requester host server to Recursive DNS Server

  2. Recursive DNS server send DNS Request to Root DNS Server

  3. Root DNS Server resolve and provide IP Address of the Authoritative DNS Server

  4. Recursive DNS server send DNS Request to Authoritative DNS Server

  5. Authoritative DNS Server resolve and provide IP address of the requested host server

  6. Recursive DNS server send IP address of the requested host server to DNS Client

What is DNSSEC?

DNSSEC (Domain Name System Security Extensions) is a technology that was developed to, among other things, protect against such attacks by digitally ‘signing’ data so you can be assured it is valid. However, in order to eliminate the vulnerability from the Internet, it must be deployed at each step in the lookup from root zone to final domain name (e.g., www.icann.org). Signing the root (deploying DNSSEC on the root zone) is a necessary step in this overall processii. Importantly it does not encrypt data. It just attests to the validity of the address of the site you visit.

 

Why do you need DNSSEC?

DNSSEC is intended to protect against ‘man-in-the-middle’ DNS spoofing attacks and ‘cache poisoning’ by ensuring DNS information is validated cryptographically before end-users traffic are directed to a website.

When users access a website using its domain name e.g. , the system’s DNS resolver will first query for the IP address of the website. When the DNS resolver (e.g. ISP’s resolver) is making its query, it is possible for an attacker to trick the resolver to accept a fake IP address. This is known as a ‘man-in-the-middle’ attack.

Most DNS resolvers also cache the returned IP address to speed up responses for future queries for the same domain name, either from the same user or other users. Therefore, if an attacker has managed to trick the DNS resolver to accept a fake IP address, the fake IP address is now cached by the DNS resolver. This is known as ‘cache poisoning’. When there are subsequent queries of the same domain name by other users (e.g. other users on the same ISP), they will now be re-directed to the fake IP address as they are receiving the cached, and incorrect, IP address as opposed to the legitimate website’s IP.

 

How to know if the Domain has DNSSEC?

 

You can check at https://centralops.net/co/DomainDossier.aspx

What is DNSSEC and why is it important?

DNSSEC stands for “Domain Name System Security Extensions”. It is a security feature of the Domain Name System (DNS) which validates DNS information (e.g. IP address) for a domain name. Through the use of cryptographic digital signatures, DNSSEC technology ensures that an end-user is accessing the actual website or other services corresponding to the domain name.  In other words, DNSSEC prevents an attacker from redirecting end-users (at the DNS level) to a fake website or service.

 

What does DNSSEC protect against exactly?

DNSSEC is intended to protect against ‘man-in-the-middle’ DNS spoofing attacks and ‘cache poisoning’ by ensuring DNS information is validated cryptographically before end-users traffic are directed to a website.

 

What is DNS “man in the middle” attack and cache poisoning?

When users access a website using its domain name e.g. , the system’s DNS resolver will first query for the IP address of the website. When the DNS resolver (e.g. ISP’s resolver) is making its query, it is possible for an attacker to trick the resolver to accept a fake IP address. This is known as a ‘man-in-the-middle’ attack.

Most DNS resolvers also cache the returned IP address to speed up responses for future queries for the same domain name, either from the same user or other users. Therefore, if an attacker has managed to trick the DNS resolver to accept a fake IP address, the fake IP address is now cached by the DNS resolver. This is known as ‘cache poisoning’. When there are subsequent queries of the same domain name by other users (e.g. other users on the same ISP), they will now be re-directed to the fake IP address as they are receiving the cached, and incorrect, IP address as opposed to the legitimate website’s IP.

 

How does DNSSEC work?

DNSSEC uses cryptography signatures to create a “chain of trust”. DNSSEC uses this “chain of trust” to validate that the information users receive originates from the correct DNS servers. If the information cannot be validated, it discards the information. Thus if users visit a DNSSEC-protected website and the DNS response is modified by a hacker (through a ‘man-in-the-middle’ attack), the DNSSEC-aware DNS resolver or application can detect the fake information and discard it.

How to get DNSSEC?

We can help you to enable DNSSEC for your domain. Please contact us for more details.

 

Cyber Security Agency (CSA) of Singapore – Cyber Health Lookup Tool

Cyber Health Lookup is a free online tool developed by the CSA that allows Singaporeans to check the security status of their internet-connected devices, such as laptops, smartphones, and tablets. The tool scans the devices for known vulnerabilities and security weaknesses and provides users with a report on their overall cyber health.

To know more about CSA Cyber Health Lookup Tool.