Practical Steps for Reducing Exposure and Detecting Compromise
summary
Shows concrete exploits (DNS exfiltration, DNS tunnels for botnet C2, DGAs, EDNS0 abuse, cache poisoning, rebinding, MITM, TLD takeover, amplification and malformed‑packet tunneling) and concrete defenses: use firewalls to restrict outbound DNS and rate limit queries, lock network settings via Group Policy, separate recursive (Unbound) and authoritative servers, enforce short TTLs (five minutes), run Graylog/NXLog/Packetbeat to collect Microsoft DNS debug logs and packet captures with Wireshark/tcpdump, and deploy anycast plus multi‑provider and DDoS mitigation for authoritative zones.
AI-written summary · about
chapters (7)
- 0:00Introduction to DNS security
- 1:32DNS exploits against confidentiality
- 6:11DNS exploits against integrity
- 11:52DNS exploits against availability
- 16:46Mitigating DNS attacks
- 23:30Monitoring DNS for compromise
- 33:45Q&A and closing remarks
related talks
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
26mMisuse of DNS, the Second Most Used Protocol
41mWhen Cybersecurity Is More Than Just Vulnerabilities
47mDNS On Fire
43mBlock DNS exfiltration with dnsmasq proxy
10mAvoiding DNS Pain
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
34mUsing DNS as a layer of defense