DNS Security Issues (Misconfigurations)

DNS fall with security issues in a relation to:

Service/traffic redirection:

DNS requests(traffic) to any site, could be redirected to an IP address of a malicious attacker’s site using man in the middle attack or any other type of attacks.
As a user, you should verify the authenticity through cryptographic signature hashes even with trusted sites.
Similarly, name servers with MX records can be modified to redirect
e-mail from one domain to another.



Denial of service:

Instead of redirecting records elsewhere, they can be redirected to 10.1.1.12
or any another address range that does not exist which may deny legitimate target from being reached.


Zone transfers:

Domain record exchanges such as updating information across name servers can reconfigure packet routing across a network.

Past versions of name servers had no security, and anyone with access to programs like nslookup and dig were capable of issuing them.

DNS zone transfers should only be allowed between DNS servers and clients that actually need it.
DNS master is only transmitting zone information to (and only to) the IP addresses of slave-1/2..etc DNS servers, slave should not transmit to anyone in most configurations.

Also protection with zone transfers can be obtained by implementing DNS keys and even encrypted DNS payloads.

Else than that Instead of limiting transfers purely based on IP address, sites can maintain cryptographic signatures or relies on public key cryptography as in DNS security extensions (DNSSEC)


Predictable query IDs:

A query ID is included within a packet to uniquely identify sessions, such a query within a request is a security issue that allows an attacker to poison domain name server caches with forged address resolution information, a way to reduce the breadth of this attack random query IDs is used.

Secure How-To: Not only

-Using complete physical separation of internal recursive queries and external public name service to prevent DNS cache poisoning.
-Also securing dns could be by redundancy and load balancing which in turn requires that networks house more than one DNS server.

E-mail Risk ( Data vulnerabilities )

As a universally implemented protocol, email should be a target
for attacks and risk ; due to the very sensitive nature of the data or information that is transmitted.

E-mail at its core is safe because it does not transmit directly executable(binary) code.
But an e-mail client starts adding features to be more of a collaboration tool, such as Outlook which embed malcode that has chances of being decoded and launched.

An e-mail protocol like Post Office Protocol (POP), was used in the clear,
which means when a mail was received, it was transmitted with the POP3 protocol.
In such case, the entire e-mail fit into one packet and opportunity to capture packets and read e-mail content isn't off-topic.

Capturing and modifying of e-mail can be done either as a man-in-the-middle attack (using ARP spoofing tool, such as ettercap) or as a replay attack.

Man-in-the-middle attacks are best avoided by using encryption and digital signing of messages.

On the other hand, Spam DoS attacks are a result of spammers using false domains in the e-mails they send.
The most danger type of these attacks is when a spammer forges an address.

Spam attacks avoided by referencing a blacklist which is a database of known internet addresses (by domain names or IP addresses) used by spammers.
Blacklisted addresses return invalid responses so the server rejects the e-mail.


Proper e-mail authentication is also a security concern.

-Login authentication : user name and password passed separately encoded with base64.
The user name and password are then used to authenticate to the mail server.

- onPOP before SMTP : preventing spammers from using a mail server relay.
SMTP relaying is permitted by an IP address if that IP address has participated in a valid POP session in the prior X minutes.
The POP protocol requires a valid password so spammers will not be able to use POP prior to using the mail server for relaying.

A mail relay sits in the DMZ outside the perimeter firewall with a benefit having all mail received first by this mail relay which can check for unwanted scripts, viruses, and questionable attachments and also a good place to put spam protection, such as blacklist monitoring and spam filtering.

Securing e-mail traffic: discussed previously
Creating a secure tunnel for using less secure e-mail protocols can be a strong method of protecting the privacy and integrity of the e-mail.
With an SSH tunnel, we can still have the protection of the SSH encryption, in SMTP/POPing.

Later talking about SPF, DomainKeys ...etc

UNIX/Linux as a poor vulnerability target

UNIX has some characteristics that make it less attractive for security attacks

Unix is still primarily used on different platforms.
This use, make the average UNIX user more knowledgeable about the operating system and security.

There are many scripting techniques in UNIX.
Unlike Windows, the scripting is not integrated into applications (such as Outlook and Word).

In UNIX, scripts can be integrated into applications such as mail and word processing, but not to be _the default configuration_.

This makes UNIX much less vulnerable than a Windows system that is running Outlook and allows users to commonly run Visual Basic scripts.

Also the inability of a common user to alter an executable is a severe restriction on viruses and worms that depend on users to propagate their malware.

On the other hand in Unix, Physical Security is somehow perfectly controlled:
(monitoring hardware changes)
A software tool library like kudzu, detects and configures new and/or changed hardware on a RedHat Linux system and currently ported to different other distros.

What's notable that it detects the current hardware and checks it against a database stored in /etc/sysconfig/hwconf, which mean it can be an eye on system hardware monitoring any changes.

Another piece in Unix is its partitioning of disks and file systems which can be a physical security issue.

File systems, such as ext3 in Linux, use journaling to make the recovery of damaged file systems more reliable.

Journaling provides for a fast file system restart in the event of a system crash, using database techniques, journaling can restore a file system in a matter of minutes, or even seconds.

Not finished yet....

Securing communication protocol traffic (SSH tunneling).

A useful option for secure communication between client/server is to tunnel the communication inside the Secure Shell protocol (SSH).

It can be used to tunnel POP3 and SMTP traffic using ssh.
-Sure u must have both ssh client and ssh server installed on the two ends.
-Create a local ssh tunnel on local machine (ex.port 5110) to the POP3 server's port 110 or SMTP 25
# ssh -f -N -L 5110:localhost:110 user@POP3_server

Or even simply binding to a privileged port (110, the POP port)

# ssh -L 110:mailhost:110 -l user -N mailhost

Same, you can also forward SMTP for outgoing mail (port 25), single ssh line can have multiple -L entries, like this:

# ssh -L 110:mailhost:110 -L 25:mailhost:25 -l user -N mailhost

-U can still check for port forwarded :
Telnet localhost (forwarded port)/
You should see the POP3 server's banner information.

-Finally you have to configure your mail client to access your mail via POP3 using mail server localhost and desired forwarded port.

Vulnerability in Google Gmail

This bug has already been corrected, that's why it's been
published (October-November 2005)
Due to the bug's gravity (that allowed in a
few simple steps to login in any Gmail account), it was
decided not to publish this document while the bug was
still active. Motives are more than obvious because
ALL Gmail accounts were vulnerable to the bug.

Quantum cryptography:

Is an approach based on quantum physics for secure communications.

A central problem in cryptography is the key distribution problem.
One solution, that of public-key cryptography, relies on the computational
difficulty of certain hard mathematical problems (such as integer factorisation),
whereas quantum cryptography relies on the laws of quantum mechanics.
Quantum cryptographic devices typically employ individual photons of light.

How...... ?

it is possible to encode information into some quantum properties of a photon
in such a way that any effort to monitor them necessarily disturbs them in
some detectable way. The effect arises because in quantum theory, certain
pairs of physical properties are complementary in the sense that measuring
one property necessarily disturbs the other.

SO..... ?

Two different types of quantum cryptographic protocols were invented:

The first type uses the polarization of photons to encode the bits of information
and relies on quantum randomness to keep you from learning the secret key.

The second type uses entangled photon states to encode the bits and relies
on the fact that the information defining the key only "comes into being"
after measurements performed.

Cool ........ :)

Malicious cryptography: armored virus

When the malware is detected, it is regarded as new code to be analyzed.
When the analysis is completed, signatures and heuristics are created to
enable anti-virus software to block this malware

In order to avoid this "problem," a malware writer must delay, or even
forbid, the analysis of his malignant creature what's called _armored virus_.

It has several techniques:

Polymorphism: both the binary and the process were ciphered

Stealth: several interruptions, including debugging ones, are hooked
by Whale, and it also hides in high memory before decreasing the max
limit of memory known by DOS, which was prominent at the time.

Armoring: the code changes depended on the architecture (8088 or 8086),
and had what is known as anti-debug
(if a debugger is detected, the keyboard is blocked and Whale kills itself).