Brief Overview: Types of DNS Attacks & its Mitigation

First, we understand what is DNS. DNS, short for Domain Name System, is a protocol that acts as a directory that translates a domain name, e.g. allabouttesting.org, into an IP address, e.g. 14.32.43.56. In simple words, when a user types allabouttesting.org, DNS converts the URL into its corresponding IP address, e.g. 14.32.43.56.

Now, what are DNS attacks? DNS attacks are possible exploits that may be executed against the system by taking advantage of weaknesses in DNS. This blog list DNS Attacks & Mitigation techniques.

Types of DNS Attack & its Mitigation

Cache Poisoning - In this type of attack, the attacker poisons DNS cache entries and redirects genuine requests to malicious websites. Another name of the attack is DNS poisoning. DNS cache entries may be corrupted either by malicious malware or by network attacks that inject invalid DNS entries into the cache. You can use the tool Ettercap, which is an open-source tool and available on the Linux Kali distro.

Mitigation: Use reputed antivirus on your system, keep Antivirus up-to-date, ensure HTTPS connection on visiting websites, Never download suspicious files on your system as those files may be malicious, use VPN, etc.

DNS amplification - In this type of attack, the attacker sends UDP packets with spoofed IP addresses to a DNS resolver. The spoofed address is actually the real IP address of the victim. Here, the target is not able to distinguish between authentic and bogus DNS replies.

Mitigation: Usage of configured firewall, sufficient network capacity 

Distributed Denial of Service (DDoS) - The attacker uses multiple botnets to generate massive resolution requests to flood the target.

Mitigation: Usage of large distributed DNS system 

Fast-flux DNS - Attackers use a technique of Fast Flux DNS to swap DNS records with compromised hosts to delay or evade detection.

Mitigation: This type of attack may not be easily mitigated.

Zero-day attack - This type of attack uses unknown vulnerabilities in DNS and exploits the system.

Mitigation: Difficult to mitigate as very limited information is available in the public domain.