Reading Room

DNS Issues

Featuring 16 Papers as of April 3, 2014


  • Implementation and use of DNS RPZ in malware and phishing defence Alex Lomas - April 3, 2014

    Many organisations, large and small, have a need for outbound content filtering.

  • Detecting DNS Tunneling Masters Greg Farnham - March 25, 2013

    Web browsing and email use the important protocol, the Domain Name System (DNS), which allows applications to function using names, such as example.com, instead of hard-to-remember IP addresses.

  • DNS Sinkhole Guy Bruneau - November 9, 2010

    Why use a DNS sinkhole? The Domain Name Service is a core service used to access the Internet, so control of DNS equates to at least partial control of Internet traffic. By intercepting outbound DNS requests attempting to access known malicious domains, such as botnets, spyware, and fake antivirus, an organization can control the response and prevent organization computers from connecting to these domains. This activity prevents unwanted communications and is capable of mitigating known and unknown threats hosted on known malicious or unwanted domains.

  • Visualizing the Hosting Patterns of Modern Cybercriminals Andrew Hunt - September 21, 2010

    The Domain Name Service (DNS) is critically important to translating human readable domain names into Internet Protocol (IP) addresses. Take Google, for example. Without DNS, users would find it extremely difficult to connect to one of the hundreds of IP addresses providing Google's services. Resolving 'google.com' via DNS provides the user almost instantaneous access to Google content from the closest four of its thousands of servers. This speed of association and resiliency has been the backbone of the Internet's success. This holds true for those serving legitimate content and services, and for those meaning to do harm. This paper will demonstrate how historical DNS resolution data can be used to identify patterns of malicious domain registrations. It will also show how to identify weak points, assisting security analysts in the defense of their networks.

  • CURRENT ISSUES IN DNS Masters Craig Wright - December 30, 2008

    This paper will look at the issues facing DNS as well as conduct an analysis of the existing DNS infrastructure to assess its state and weaknesses.

  • DNS Spoofing by The Man In The Middle Ian Green - May 5, 2005

    This paper is based on a vulnerability in the Windows XP DNS resolver. While other parties have recently published this vulnerability, the vulnerability was independently discovered during research for this paper.

  • The Evolving Threats to the Availability and Security of the Domain Name Service John Holmblad - December 13, 2003

    This paper provides an overview of the role of the Domain Name Server (DNS) system among the essential components that comprise the Internet and the World Wide Web as we know it today, examines the security related aspects of its operation, along with some of the key exploits that have been mounted in the last several years against the system and the services that it provides.

  • DNS, DNSSEC and the Future David Hinshelwood - October 31, 2003

    The aim is to mitigate the risks of mis-configuration and attack so down time is kept to a minimum or compensated for by reducing the single point of failure.

  • Security Issues with DNS Florent Carli - October 31, 2003

    This document first reviews some basics about how DNS works, then goes into explaining the different ways a hacker can attack the DNS protocol implementation to use it to his own advantage.

  • The Achilles Heal of DNS Christopher Irving - October 31, 2003

    This paper will attempt to illustrate consequences of protocols associated with Routing and DNS attacks which either completely lacks or has very poor methods of authentication.

  • DNS Security Considerations and the Alternatives to BIND Lim Chor - October 31, 2003

    This paper discusses important considerations regarding DNS Security.

  • Current Issues in DNS Security: ICANN's November 2001 Annual Meeting James Sweetman - October 31, 2003

    After a brief, policy-level introduction to DNS and ICANN, this paper summarizes the results of a 4-day meeting held during November 2001, on DNS security issues addressing: existing DNS security measures, security risks in the DNS and number management, and the responses by ICANN and the community.

  • Defense in Depth for DNS Cheng Teoh - October 31, 2003

    This paper will focus on security for the most widely used DNS server on the Internet, namely the Berkeley Internet Name Domain (BIND).

  • Why is securing DNS zone transfer necessary ? Steve Lau - October 31, 2003

    This paper will focus on the reason for securing DNS zone transfers between DNS Name Servers, concentrating on the use of allow-transfer statement in Berkley Internet Name Domain (BIND) DNS to accomplish the goal of preventing DNS poisoning or spoofing.

  • Installation of a Red Hat 9.0 server with DNS services, emphasising security Mark Chandler - October 31, 2003

    This paper seeks to provide an edited account of the work done by the author to create a minimal-install, primary DNS server based on a Linux platform including some discussion as to why certain decisions were made and the reasons for the method used to build the system.

  • How Secure are the Root DNS Servers? Susan Baranowski - October 31, 2003

    This paper addresses the current state of the root name server system and its operation.

Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

All papers are copyrighted. No re-posting or distribution of papers is permitted.

Masters This paper was created by a SANS Technology Institute student as part of their Master's curriculum.