topic Re: Hacking DNS TechTalk: Video, Slides, and Q&A in General Topics

Hacking DNS TechTalk: Video, Slides, and Q&A

PhoneBoy — Wed, 26 Jul 2023 17:07:44 GMT

Slides attached below.
Q&A appears below the video.

(view in My Videos)

Do you have a recent statistics what's the percentage of secure DNS requests (TCP/853, HTTPS etc.) in total name resolver traffic nowadays?

Roughly 5%.

How many Root Servers all over the world and how sync is done among them?

There are 13 root servers. More details here.

Is PTR the same as reverse lookup?

Yes, PTR records are IP to name mappings.

What book is Ralph recommending?

DNS and Bind (5th Edition) by Cricket Liu and Paul Albitz. It's available on Amazon (among other places): https://www.amazon.com/DNS-BIND-5th-Cricket-Liu/dp/0596100574/ref=sr_1_1?crid=3FWUOTXHYDAO&keywords=dns+and+bind&qid=1690383797&sprefix=dns+and+bind%2Caps%2C108&sr=8-1

What kind of adoption are you seeing DNSSEC getting?

According to the public source, it is not growing fast, currently roughly at about 5% usage.

What is the best practice for the TTL?

Unless the IP address for the record changes regularly (i.e. dynamic IP), the TTL should not be short. A short TTL will increase load on your DNS servers.

How do Check Point customers detect/prevent DNS tunneling attacks?

Use our Threat Prevention blades. Specifically:

IPS: preventing known attacks trying to utilize known vulnerabilities on DNS infrastructure
Anti-Virus: preventing download of malicious files
Anti-Bot: preventing access to known malicious sites and verifying traffic behavior
DNS requests are verified against ThreatCloud. In case of being malicious, the request is answered with the DNS Trap IP address as response (see sk74060 and Threat Prevention Administration Guide R81.10 for details). For DNS Tunneling protection, see sk178487.
Protocol Parsers (Inspection Settings): making sure protocols respect defined standards

Can Check Point ingest external threat feeds?

We have various methods to ingest threat feeds, yes (ioc_feeds using AV/AB in R80.x, Network Feeds in R81.20+). If you are ingesting threat feeds (regardless of mechanism), it is HIGHLY recommended to upgrade to R81.20 since it is able to support substantially more indicators.

Can you explain the deep learning part - how does it does this?

Out of scope for this session, but we intend to cover it in the future.

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

the_rock — Wed, 26 Jul 2023 16:47:25 GMT

Missed the presentation, will watch it later on, but for anyone who cares to watch...here is in my opinion, the BEST video on the Internet about DNS. This youtube channel is gold...guy explains things like a pro.

Andy

How a DNS Server (Domain Name System) works. - YouTube

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

ralphbonnell — Wed, 26 Jul 2023 22:23:20 GMT

thanks for sharing! this certainly does a great job of clearly describing the DNS process!

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

the_rock — Thu, 27 Jul 2023 03:56:23 GMT

By far, the best explanation out there, in my view.

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

_Val_ — Thu, 27 Jul 2023 07:39:12 GMT

Ralph is being too nice. This is DNS for dummies video, which is useful, but also very basic 🙂

@the_rock what the TechTalk, Ralph did a great job taking it to the actual expert level.

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

the_rock — Thu, 27 Jul 2023 08:48:17 GMT

Yes! Watched it already, fantastic work.

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

tjiang — Thu, 27 Jul 2023 15:16:53 GMT

nice to see you here.😀

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

the_rock — Thu, 27 Jul 2023 15:45:43 GMT

Buddyyyy, Im always here HAHAHAHA...hope ur well!!

Andy

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

Arne_Boettger — Wed, 09 Aug 2023 12:16:17 GMT

Hi,

I enjoyed the presentation. But at the end, there is dangerous misinformation spread. TCP Port 53 is NOT only used for zone transfers. This is plainly wrong. Any DNS Resolver can move to TCP if the response is too large for a single UDP packet. This happened e.G. when Google started using more IPv6 on their authoritative DNS Servers...

ALWAYS allow both TCP and UDP Port 53 for your clients towards the resolvers.

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

the_rock — Wed, 09 Aug 2023 12:34:58 GMT

I guess answer depends on who you ask, but you make a good point.

Andy

Re: Hacking DNS TechTalk: Video, Slides, and Q&A

ralphbonnell — Wed, 09 Aug 2023 14:15:31 GMT

You are correct. I did not realize this and if you watch the rest of the presentation you will hear this get mentioned in the Q&A at the end so I have a chance to correct that mistake….