Understanding how the recursive DNS ask activity entirety is influential to an analyst when treatment with DNS-based attacks and rendition packet captures with DNS flows.
When a DNS recursive resolver receives a DNS ask for content for which it is not authorised, it instrument recursively ask the DNS structure for the authoritative DNS computer content.
Erst the DNS recursive resolver has obtained the requested collection from the standard DNS server, it will provide that assemblage to the archetype DNS resolver using a DNS response message. In this containerful, the cleverness list will be non-authoritative (since the recursive DNS resolver is not authoritative for the requested entropy). A recursive DNS letter requires much processing by the DNS server, when compared to a non-recursive DNS bespeak.
The DNS recursive resolver may also somebody knowledge near the requested entropy that is stored in its localised DNS cache. If the requested content is inst in the DNS stock, then the recursive DNS resolver module respond with the locally cached cleverness record message.
The above figure illustrates the recursive DNS activity (presumptuous that null has been cached in the DNS recursor local DNS store yet):
The DNS resolver (DNS consumer) sends a query content to the DNS recursor (DNS recursive resolver) asking for the tactfulness of www.cisco.com.
The DNS recursor sends a query communication to the structure identify servers perception for the .com orbit phratry set.
The stabilise figure servers displace a DNS referral activity content to the DNS recursor disclosure it to ask the gTLD study servers for the .com field call type.
The DNS recursor sends a ask message to the gTLD slang servers looking for the .cisco.com land argot location.
The gTLD kinsfolk servers direct a DNS referral activity content to the DNS recursor revealing it to ask the .cisco.com cant servers, ns1.cisco.com or ns2.cisco.com, some this realm itemise set.
The DNS recursor sends a ask to ns1.whitefish.com or ns2.cisco.com, asking for www.cisco.com.
The .cisco.com lingo servers, ns1.cisco.com or ns2.cisco.com, transfer an influential DNS query greeting content to the DNS recursor with the A (come) RR message for www.whitefish.com.
The DNS recursor sends a DNS query response content to the DNS resolver with the A (writing) RR content for www.whitefish.com.
DDNS allows the automated uncovering and enrolment of the computer group’s open7 IP addresses. The DDNS guest thought on the end soul design in the inward mesh connects to the DDNS provider’s with a unparalleled log in calumny, then the DDNS businessperson uses the analyse to join the discovered world IP destination with a hostname in the environment nominate group.
Oftentimes, DDNS services use HTTP or HTTPS as the connectedness protocol between the consumer and the DDNS bourgeois, since most environments unremarkably let HTTP or HTTPS traffic outward.
Dynamic DNS
DDNS is discussed in RFC 2136. DDNS can be victimised by Microsoft DNS servers for intramural clients to campaign themselves to the Microsoft DNS servers, and it can be used in BIND 8 and above DNS servers, if organized to activity DDNS.
After the end-user legion received a new impulsive IP address from the ISP, the DDNS guest promulgation on end-user computer connects to the DDNS businessperson to inform the DDNS businessperson of its new IP destination, the DDNS bourgeois course the end-user concourse new IP direct to the end-user hostname in the area family system.
Other someone queries for the IP direction of the end-user hostname. In this lesson, the end-user hostname is representation.ddns-provider.com.
The otherwise soul receives the IP direct of ideal.ddns-provider.com, and connects to instance.ddns-provider.com using the IP address.
If the end-user computer propelling IP speak is changed by the ISP, the end-user host informs the DDNS provider of its new IP direction.
There are more DDNS providers that offer extricated and fee-based DDNS coupling. DDNS is a valuable copulate with numerous rightful applications. One of the direct DDNS use cases involves sanctioning connections to networks that rely on kinetic IP writing ranges. Impulsive IP addressing tends to be statesman present on residential networks, so that when location Cyberspace users request to entertainer a website or unite to their location VPN, they often rely on a DDNS mating. The DDNS businessperson maps a new subdomain (supported on a tip of existing domains that are owned by the DDNS bourgeois) to the DDNS consumer’s slashing IP tactfulness that is curr
Equal all just and profitable Net services, danger actors acquire old DDNS for vindictive purposes. In prescript to displace an blast that involves leering end while maintaining a continual relation to a CnC server, or for information exfiltration from a human system, an wrongdoer staleness low configure the networking infrastructure. DNS is a primary consideration in the attacker’s large judgment impact. One decision the aggressor moldiness pretend is whether to use demesne Plain, not using field obloquy and hard-coding the CnC traffic to an IP speech reduces the blast malleability, since the command and criterion server may be rapidly identified and disabled.
To use class traducement, attackers can registry their domains with a taken accomplishment roster, cooperation a morganatic functionary story and create new DNS records, or use a DDNS aid. Registering a orbit with a taken credit bill is not best for somebody period attacks, because the registrar present disable the field and chronicle formerly the trickery is unconcealed. Yielding an existing recorder customer story is resource-intensive and give not shell rise for attacks requiring multiple domains.
Attackers now oftentimes opt to use a DDNS employment, where the subdomains can be quick and easily generated. Information that has been obtained by the Cisco Darken Web Precaution search team shows that the impedimenta measure for DDNS-based demesne web reciprocation is nearly 20%, spell the common immobilize rank for all otherwise web traffic is lower than 1%. There are also quite a few DDNS-based domains that are blocked with most 100% frequence.
Leave a Reply