FIT5037 - Lecture 04: Domain Name System (DNS) Security Flashcards

Question 1

NS Record

Accepted Answer

A Name Server record that delegates a DNS zone to use a specific authoritative nameserver.

Question 2

SOA Record

Accepted Answer

A Start of Authority record that stores administrative information, zone transfers, and contact details for a DNS zone.

Question 3

SRV Record

Accepted Answer

A Service record that defines the hostname and port number for specific services or protocols within a domain.

Question 4

PTR Record

Accepted Answer

A Pointer record used in reverse DNS lookups to resolve a given IP address back to its associated domain name.

Question 5

Time-To-Live (TTL)

Accepted Answer

A parameter in a DNS record that defines the duration in seconds for which the record is allowed to be cached by resolvers before expiring.

Question 6

DNS Cache

Accepted Answer

A temporary storage mechanism on local resolvers that retains previously retrieved DNS records to improve resolution speed and reduce upstream traffic.

Question 7

DNS Spoofing

Accepted Answer

An attack vector aimed at introducing a fraudulent IP address into a client's DNS resolution path, redirecting users to a malicious server.

Question 8

Local DNS Cache Poisoning

Accepted Answer

An attack where an adversary on the local network injects a forged DNS response into a local resolver before the legitimate upstream nameserver can reply.

Question 9

Remote DNS Cache Poisoning

Accepted Answer

An attack where an off-path adversary tries to poison a resolver's cache by guessing transaction IDs and UDP port numbers from a remote location.

Question 10

Transaction ID (DNS)

Accepted Answer

A 16-bit random field in the DNS header used by resolvers to match outgoing queries with incoming responses, introducing 16 bits of entropy.

Question 11

DNS Cache Effect

Accepted Answer

A defensive behavior where a failed spoofing attempt results in the legitimate record being cached, forcing the attacker to wait for the TTL to expire before trying again.

Question 12

Source Port Randomization (SPR)

Accepted Answer

A countermeasure that randomizes the UDP port from which queries are sent, adding up to 16 additional bits of entropy to protect against spoofing.

Question 13

Kaminsky Attack

Accepted Answer

A technique that circumvents the cache effect by querying unique, non-existent subdomains, forcing the resolver to issue a new query every time.

Question 14

Kaminsky Delegation Exploit

Accepted Answer

An attack that uses unique subdomain queries to guess the transaction ID and inject forged NS records, hijacking authority over the entire target domain.

Question 15

DNSSEC

Accepted Answer

A suite of extensions that provides cryptographic origin authentication and integrity protection to DNS records.

Question 16

Object Security

Accepted Answer

A security model (used by DNSSEC) that protects the data records themselves with digital signatures, ensuring integrity and authenticity regardless of the path used to retrieve them.

Question 17

Channel Security

Accepted Answer

A security model (like TLS) that secures the communication path itself, establishing confidentiality, integrity, and authentication for a specific TCP connection.

Question 18

DNS Rebinding

Accepted Answer

An exploit where a malicious website uses extremely short TTLs to change its DNS resolution to a victim's private IP, bypassing the browser's Same-Origin Policy.

Question 19

Domain Name System (DNS)

Accepted Answer

A hierarchical, distributed database that translates human-readable hostnames into computer-friendly IP addresses.

Question 20

DNS Recursor

Accepted Answer

A recursive resolver that receives DNS queries from client applications and makes iterative upstream requests to satisfy the query.

Question 21

Root Nameserver

Accepted Answer

The first step in DNS resolution that directs recursive resolvers toward specific Top-Level Domain (TLD) nameservers.

Question 22

TLD Nameserver

Accepted Answer

A nameserver that manages the domain registry for specific top-level domains, such as .com, .net, or country-code domains.

Question 23

Authoritative Nameserver

Accepted Answer

The final nameserver in the lookup chain that holds the actual DNS records for a domain and returns the requested IP address.

Question 24

DNS Zone

Accepted Answer

A contiguous segment of the DNS namespace that is grouped together and managed by a single administrative authority.

Question 25

/etc/hosts

Accepted Answer

A local operating system file that maps hostnames to IP addresses, which is queried before the machine makes a network DNS request.

FIT5037 - Lecture 04: Domain Name System (DNS) Security

Card Preview

Related Flashcard Sets

Rust Programming Language - Ownership, Borrowing & Concurrency

Classical Mechanics - Kinematics, Dynamics & Energy

CFA Level 1 - Investment Tools & Ethics

BIO102 - Cell Biology & Genetics Fundamentals