Hacking DNS TechTalk: Video, Slides, and Q&A

[PhoneBoy]

Slides attached below.
Q&A appears below the video.

Do you have a recent statistics what's the percentage of secure DNS requests (TCP/853, HTTPS etc.) in total name resolver traffic nowadays?

Roughly 5%.

How many Root Servers all over the world and how sync is done among them?

There are 13 root servers. More details here.

Is PTR the same as reverse lookup?

Yes, PTR records are IP to name mappings.

What book is Ralph recommending? 

DNS and Bind (5th Edition) by Cricket Liu and Paul Albitz. It's available on Amazon (among other places): https://www.amazon.com/DNS-BIND-5th-Cricket-Liu/dp/0596100574/ref=sr_1_1?crid=3FWUOTXHYDAO&keywords=...

What kind of adoption are you seeing DNSSEC getting?

According to the public source, it is not growing fast, currently roughly at about 5% usage.

What is the best practice for the TTL?

Unless the IP address for the record changes regularly (i.e. dynamic IP), the TTL should not be short. A short TTL will increase load on your DNS servers.

How do Check Point customers detect/prevent DNS tunneling attacks?

Use our Threat Prevention blades. Specifically:

• IPS: preventing known attacks trying to utilize known vulnerabilities on DNS infrastructure
• Anti-Virus: preventing download of malicious files
• Anti-Bot: preventing access to known malicious sites and verifying traffic behavior
• DNS requests are verified against ThreatCloud. In case of being malicious, the request is answered with the DNS Trap IP address as response (see sk74060 and Threat Prevention Administration Guide R81.10 for details). For DNS Tunneling protection, see sk178487.
• Protocol Parsers (Inspection Settings): making sure protocols respect defined standards

Can Check Point ingest external threat feeds?

We have various methods to ingest threat feeds, yes (ioc_feeds using AV/AB in R80.x, Network Feeds in R81.20+). If you are ingesting threat feeds (regardless of mechanism), it is HIGHLY recommended to upgrade to R81.20 since it is able to support substantially more indicators.

Can you explain the deep learning part - how does it does this?

Out of scope for this session, but we intend to cover it in the future.

[the_rock]

Missed the presentation, will watch it later on, but for anyone who cares to watch...here is in my opinion, the BEST video on the Internet about DNS. This youtube channel is gold...guy explains things like a pro.

Andy

How a DNS Server (Domain Name System) works. - YouTube

[ralphbonnell]

thanks for sharing!  this certainly does a great job of clearly describing the DNS process!

[the_rock]

By far, the best explanation out there, in my view.

[_Val_]

Ralph is being too nice. This is DNS for dummies video, which is useful, but also very basic 🙂

@the_rock what the TechTalk, Ralph did a great job taking it to the actual expert level.

[the_rock]

Yes! Watched it already, fantastic work.

[tjiang]

nice to see you here.😀

[the_rock]

Buddyyyy, Im always here HAHAHAHA...hope ur well!!

Andy

[Arne_Boettger]

Hi,

I enjoyed the presentation. But at the end, there is dangerous misinformation spread. TCP Port 53 is NOT only used for zone transfers. This is plainly wrong. Any DNS Resolver can move to TCP if the response is too large for a single UDP packet. This happened e.G. when Google started using more IPv6 on their authoritative DNS Servers...

ALWAYS allow both TCP and UDP Port 53 for your clients towards the resolvers.

[the_rock]

I guess answer depends on who you ask, but you make a good point.

Andy

[ralphbonnell · Accepted solution]

You are correct.  I did not realize this and if you watch the rest of the presentation you will hear this get mentioned in the Q&A at the end so I have a chance to correct that mistake….