DNS - Domain Name System
Articles and resources about the domain name system.
-
DNSChanger Diagnostic
- "DNSChanger is a class of malicious software (malware) that changes a user's Domain Name System (DNS) settings, enabling criminals to direct unsuspecting internet users to fraudulent websites and otherwise interfere with access to internet services. It has been associated with 'click fraud', the installation of additional malware and other malicious activities.
In November 2011, the FBI closed down a ring of cyber-criminals believed to be responsible for the worldwide spread of DNSChanger.
An estimated four million users were affected worldwide. To avoid these victims losing access to internet services, the FBI worked with the Internet Systems Consortium (ISC) to set up and operate a temporary but correct DNS solution, while giving ISPs the opportunity to assist their customers to remove their potential infection.
This temporary solution was switched off at 2pm AEST on 9 July 2012.
In most cases, if you have managed to load this webpage after this date, you are very unlikely to be affected by DNSChanger, as you would have been unable to load the webpage if you were affected. However, there are some potential circumstances in which you may be still affected by DNSChanger, as described below...
This DNSChanger Diagnositic is a joint Australian Government initiative between:
- Australian Communications and Media Authority
- CERT Australia
- Stay Smart Online "
-
Secure Domain Name System (DNS) Deployment Guide - in pdf format (897kb)
- (This document requires the use of Adobe Acrobat Reader). Recommendations of the National Institute of Standards and Technology, by Ramaswamy Chandramouli and Scott Rose. Special Publication 800-81r1, Sponsored by the Department of Homeland Security. National Institute of Standards and Technology, April 2010. "... This document provides deployment guidelines for securing DNS within an enterprise. Because DNS data is meant to be public, preserving the confidentiality of DNS data pertaining to publicly accessible IT resources is not a concern. The primary security goals for DNS are data integrity and source authentication, which are needed to ensure the authenticity of domain name information and maintain the integrity of domain name information in transit. This document provides extensive guidance on maintaining data integrity and performing source authentication. Availability of DNS services and data is also very important; DNS components are often subjected to denial-of-service attacks intended to disrupt access to the resources whose domain names are handled by the attacked DNS components. This document presents guidelines for configuring DNS deployments to prevent many denial-of-service attacks that exploit vulnerabilities in various DNS components..."
-
Need to deploy DNSSEC? NIST publishes its how-to
- Updated guidelines include new sections on cryptographically signing DNS zones, By William Jackson. Federal Computer Week, August 30, 2010. "Secure and dependable use of the Internet depends on the ability of users and devices to navigate the Web using familiar domain names that are mapped to IP addresses..."
-
DNSSEC is But One Link in the Security Chain
- By Chris Wright. CircleID, July 14, 2010. "As the implementation of DNSSEC continues to gather momentum and with a number of ccTLDs, and the .org gTLD having deployed it into their production systems, I think it is worth pausing to take a look at the entire DNSSEC situation. Whilst it is absolutely clear that DNSSEC is a significant step forward in terms of securing the DNS, it is but one link in the security chain and is therefore not, in itself, a comprehensive solution to fully securing the DNS system..."
-
DNSSEC Goes Inside the White House
- CircleID, July 15, 2010. "For months, our community has been abuzz with one word: DNSSEC. Now, it's trickling into the White House. Just yesterday, U.S. Department of Commerce Secretary Gary Locke announced, as part of a larger cybersecurity policy review, that the Commerce Department is one step closer to making "significant progress in helping the Internet become more robust and secure" by deploying DNSSEC at the root of the Domain Name System (DNS)..."
-
UK registry to implement DNS security protocol
- The system, DNSSEC, prevents hackers from redirecting people from legitimate domains to fraudulent ones, by Jeremy Kirk (IDG News Service). CSO, 1 March 2010. "Nominet, the U.K.'s domain name registry, will begin implementing a security protocol on Monday designed to protect the DNS (Domain Name System)..."
-
Google Launches Free DNS Service: What It All Means
- by MHB. TheDomains, 6 December 2009. "Google launched their public DNS product this week allowing each computer user to reconfigure their internet settings and begin using the free service. Every internet connection relies on a DNS server to resolve domain names into an ip address. Generally this service is provided free of charge by your internet provider..."
-
Introducing Google Public DNS
- Posted by Prem Ramaswami, Product Manager. The Official Google Blog, 3 December 2009. "... Today, as part of our ongoing effort to make the web faster, we're launching our own public DNS resolver called Google Public DNS, and we invite you to try it out... [Google] engineers have been working to make improvements to our public DNS resolver to make users' web-surfing experiences faster, safer and more reliable..."
-
Securing a Domain: SSL vs. DNSSEC
- By Howard Eland. CircleID, October 7, 2009. "There has been quite a bit of talk lately about the best way to secure a domain, mainly centered in two camps: using Secure Socket Layer (SSL), or using DNS Security Extensions (DNSSEC). The answer is quite simple—you should use both..."
-
An Authenticated Internet
- By Lauren Price. CircleID, September 28, 2009. "Discussions around DNSSEC are so often focused on the root, the attacks, what DNSSEC does and doesn't do and so on—and these are all valid and important points. But there is far less attention focused on the opportunities that will surface from an authenticated internet..."
-
NIST releases new draft of Special Publication 800-81 on securing DNS
- The second draft incorporates suggestions received from the first revision in March, By William Jackson. Government Computer News, August 27, 2009. "Ensuring the availability and integrity of the Domain Name System (DNS) is an essential element of cybersecurity, and the National Institute of Standards and Technology (NIST) is updating recommendations for this in its "Secure Domain Name System (DNS) Deployment Guide."..."
-
Why DNS is Broken, in Plain English
- By Kim Davies. CircleID, November 13, 2008. "At ICANN's meeting in Egypt last week, I had the opportunity to try and explain to various non-technical audiences why the Domain Name System (DNS) is vulnerable to attack, and why that is important, without needing a computer science degree to understand it. Here is the summary..."
-
Domain Moving Day the Key Relevance Way
- by Mike Churchill. SEMClubHouse, October 17, 2008. "So, you're gonna change hosting providers. In many cases, moving the content of the site is as easy as zipping up the content and unzipping it on the new server. There is another aspect of moving the domain that many people over look: DNS. The Domain Name System (DNS) is the translation service that converts your domain name (e.g. keyrelevance.com) to the corresponding IP address. When you move hosting companies, it's like changing houses, if you don't set up the Change of Address information correctly, you might have some visitors going to the old address for a while. Proper handling of the changes to DNS records makes this transition time as short as possible..."
-
Massive, coordinated DNS patch released
- by Robert Vamosi, CNET News.com. ZDNet Australia, 9 July 2008. "A security researcher has responsibly disclosed a fundamental flaw within the Domain Name System (DNS), the addressing scheme behind the common names used on the Internet. Currently, it may be possible to guess these transaction ID values in advance and assert a malicious server as the authoritative DNS server for a popular bank or e-commerce site..."
-
Should DHS get the keys to the kingdom?
- By William Jackson. Government Computer News, April 9, 2007. "The Homeland Security Department has stirred up online controversy with its suggestion that the government should hold a master key for digitally signing the root zone of the Domain Name System under the DNS Security scheme..."
This category last updated: 20 August 2012