Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
PhoneBoy
Admin
Admin
Jump to solution

Hacking DNS TechTalk: Video, Slides, and Q&A

Slides attached below.
Q&A appears below the video.

Do you have a recent statistics what's the percentage of secure DNS requests (TCP/853, HTTPS etc.) in total name resolver traffic nowadays?

Roughly 5%.

How many Root Servers all over the world and how sync is done among them?

There are 13 root servers. More details here.

Is PTR the same as reverse lookup?

Yes, PTR records are IP to name mappings.

What book is Ralph recommending? 

DNS and Bind (5th Edition) by Cricket Liu and Paul Albitz. It's available on Amazon (among other places): https://www.amazon.com/DNS-BIND-5th-Cricket-Liu/dp/0596100574/ref=sr_1_1?crid=3FWUOTXHYDAO&keywords=...

What kind of adoption are you seeing DNSSEC getting?

According to the public source, it is not growing fast, currently roughly at about 5% usage.

What is the best practice for the TTL?

Unless the IP address for the record changes regularly (i.e. dynamic IP), the TTL should not be short. A short TTL will increase load on your DNS servers.

How do Check Point customers detect/prevent DNS tunneling attacks?

Use our Threat Prevention blades. Specifically:

  • IPS: preventing known attacks trying to utilize known vulnerabilities on DNS infrastructure
  • Anti-Virus: preventing download of malicious files
  • Anti-Bot: preventing access to known malicious sites and verifying traffic behavior
  • DNS requests are verified against ThreatCloud. In case of being malicious, the request is answered with the DNS Trap IP address as response (see sk74060 and Threat Prevention Administration Guide R81.10 for details). For DNS Tunneling protection, see sk178487.
  • Protocol Parsers (Inspection Settings): making sure protocols respect defined standards

Can Check Point ingest external threat feeds?

We have various methods to ingest threat feeds, yes (ioc_feeds using AV/AB in R80.x, Network Feeds in R81.20+). If you are ingesting threat feeds (regardless of mechanism), it is HIGHLY recommended to upgrade to R81.20 since it is able to support substantially more indicators.

Can you explain the deep learning part - how does it does this?

Out of scope for this session, but we intend to cover it in the future.

(2)
1 Solution

Accepted Solutions
ralphbonnell
Employee
Employee

You are correct.  I did not realize this and if you watch the rest of the presentation you will hear this get mentioned in the Q&A at the end so I have a chance to correct that mistake…. 

--
Hubert (Ralph) Bonnell
Security Engineer
Check Point Software Technologies Inc.
Covering United States: Washington Oregon Idaho Alaska

View solution in original post

0 Kudos
10 Replies
the_rock
Legend
Legend

Missed the presentation, will watch it later on, but for anyone who cares to watch...here is in my opinion, the BEST video on the Internet about DNS. This youtube channel is gold...guy explains things like a pro.

Andy

How a DNS Server (Domain Name System) works. - YouTube

ralphbonnell
Employee
Employee

thanks for sharing!  this certainly does a great job of clearly describing the DNS process!

--
Hubert (Ralph) Bonnell
Security Engineer
Check Point Software Technologies Inc.
Covering United States: Washington Oregon Idaho Alaska
the_rock
Legend
Legend

By far, the best explanation out there, in my view.

_Val_
Admin
Admin

Ralph is being too nice. This is DNS for dummies video, which is useful, but also very basic 🙂

@the_rock what the TechTalk, Ralph did a great job taking it to the actual expert level.

the_rock
Legend
Legend

Yes! Watched it already, fantastic work.

0 Kudos
tjiang
Explorer

nice to see you here.😀

(1)
the_rock
Legend
Legend

Buddyyyy, Im always here HAHAHAHA...hope ur well!!

 

Andy

0 Kudos
Arne_Boettger
Collaborator

Hi,

I enjoyed the presentation. But at the end, there is dangerous misinformation spread. TCP Port 53 is NOT only used for zone transfers. This is plainly wrong. Any DNS Resolver can move to TCP if the response is too large for a single UDP packet. This happened e.G. when Google started using more IPv6 on their authoritative DNS Servers...

ALWAYS allow both TCP and UDP Port 53 for your clients towards the resolvers.

the_rock
Legend
Legend

I guess answer depends on who you ask, but you make a good point.

Andy

0 Kudos
ralphbonnell
Employee
Employee

You are correct.  I did not realize this and if you watch the rest of the presentation you will hear this get mentioned in the Q&A at the end so I have a chance to correct that mistake…. 

--
Hubert (Ralph) Bonnell
Security Engineer
Check Point Software Technologies Inc.
Covering United States: Washington Oregon Idaho Alaska
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events