DNS waxay u taagan tahay Nidaamka Magaca Domain^{(Domain Name System)} , tani waxay ka caawisaa browserka inuu ogaado ciwaanka IP-ga ee shabakada si uu ugu shubo kombayutarkaaga. Kaydinta DNS^{(DNS cache)} waa fayl ku jira adiga ama kombiyuutarkaaga ISP oo ka kooban liiska cinwaannada IP-ga ee mareegaha sida joogtada ah loo isticmaalo. Maqaalkani waxa uu sharxayaa waxa ay tahay DNS cache sumowga iyo DNS spoofing.

Sumeynta Cache DNS

Mar kasta oo isticmaaluhu ku qoro URL^(URL) shabakadiisa browserka, browserku wuxuu la xidhiidhaa faylka maxaliga ah ( DNS Cache ) si uu u eego haddii uu jiro gelitaanka si loo xalliyo ciwaanka IP-ga ee shabakada. browser-ku wuxuu u baahan yahay ciwaanka IP-ga ee shabakadaha si uu ugu xidhmo mareegaha. Si fudud uma isticmaali karto URL- ka si toos loogu xidho mareegaha. Waa in lagu xalliyaa IPv4 ama IPv6 ciwaanka saxda ah. Haddii diiwaanku jiro, browser-ka shabakada ayaa isticmaali doona; Haddii kale waxay aadi doontaa server-ka DNS si loo helo cinwaanka IP-ga. Tan waxaa lagu magacaabaa raadinta DNS^{(DNS lookup)} .

Kaydka DNS ayaa lagu abuuray kombayutarkaaga ama kumbuyuutarka serverka DNS ee ISP- gaaga si loo yareeyo wakhtiga lagu bixiyo weydiinta DNS -ka URL . Asal ahaan^(Basically) , khasnadaha DNS^(DNS) waa faylal yaryar oo ay ku jiraan cinwaanka IP-ga ee shabakado kala duwan oo inta badan lagu isticmaalo kombuyuutar ama shabakad. Kahor intaadan la xiriirin server-yada DNS , kombuyuutarrada shabakadu waxay la xiriiraan server-ka maxalliga ah si ay u ogaadaan haddii uu jiro gelitaanka kaydka DNS . Haddii uu jiro mid, kombiyuutarada ayaa isticmaali doona; Haddii kale server-ku wuxuu la xiriiri doonaa server-ka DNS wuxuuna soo qaadan doonaa cinwaanka IP-ga. Markaas waxay cusboonaysiin doontaa DNS -ka deegaanka^(DNS)khasnado leh ciwaanka IP-ga ugu dambeeyay ee mareegaha.

Geli kasta oo ku jirta kaydka DNS wuxuu leeyahay waqti go'an, taasoo ku xidhan nidaamyada hawlgalka iyo saxnaanta xallinta DNS . Ka dib markay muddadu dhammaato, kombayutarka ama serverka ku jira kaydka DNS ayaa la xidhiidhi doona server-ka ^(DNS)DNS oo cusboonaysiin doona gelitaanka si xogtu u noqoto mid sax ah.
Si kastaba ha ahaatee, waxaa jira dad ku sumayn kara kaydka DNS ee fal-dembiyeedka.

Sunta khasnadda waxay ka^{(Poisoning the cache)} dhigan tahay beddelidda qiyamka dhabta ah ee URL^(URLs) -yada . Tusaale ahaan, cybercriminals waxay samayn karaan degel u eg sida, xyz.com oo geli diiwaanka DNS ee kaydkaaga ^(DNS)DNS . Markaa, marka aad ku qorto xyz.com^(xyz.com) barta ciwaanka ee browserka, kan dambe waxa uu soo qaadanayaa ciwaanka IP-ga ee mareegaha been abuurka ah oo ku geyn doona halkaas, halkii uu ka ahaan lahaa website-ka dhabta ah. Tan waxaa lagu magacaabaa Pharming . Isticmaalka habkan, dembiilayaasha internetka waxay sir ka saari karaan aqoonsigaaga gelitaanka iyo macluumaadka kale sida faahfaahinta kaadhka, lambarrada bulshada, lambarrada telefoonka, iyo wax ka badan oo ku saabsan xatooyada aqoonsiga^{(identity theft)} . DNSsumaynta waxa kale oo loo sameeyaa in lagu duro malware-ka kombiyuutarkaaga ama shabakadaada. Marka aad ku degto degel been abuur ah adoo isticmaalaya kaydka DNS^(DNS) ee sumaysan , dambiilayaasha waxay samayn karaan wax kasta oo ay rabaan.

Mararka qaarkood, halkii kaydka maxalliga ah, dembiilayaasha sidoo kale waxay dejin karaan server-yada DNS been-abuurka ah si marka la weydiiyo, ay bixiyaan ciwaannada IP-ga ee been abuurka ah. Tani waa sumaynta DNS -ka heerkeedu sareeyo waxayna kharribaysaa inta badan khasnadaha DNS ee meel gaar ah taaso saamaynaysa isticmaalayaal badan.

Wax ku saabsan ka akhri^{(Read about)} : Comodo Secure DNS | OpenDNS | Google Public DNS | Yandex Secure DNS | Angel DNS.

Kaydinta DNS Spoofing

DNS spoofing is a type of attack that involves impersonation of DNS server responses in order to introduce false information. In a spoofing attack, a malicious user attempts to guess that a DNS client or server has sent a DNS query and is waiting for a DNS response. A successful spoofing attack will insert a fake DNS response into the DNS server’s cache, a process known as cache poisoning. A spoofed DNS server has no way of verifying that DNS data is authentic, and will reply from its cache using the fake information.

Kaydinta DNS Spoofing^{(DNS Cache Spoofing)} waxay u egtahay mid la mid ah sunta Cache-ga DNS^{(DNS Cache Poisoning)} , laakiin waxaa jira farqi yar. Kaydinta DNS Spoofing^{(DNS Cache Spoofing)} waa habab loo isticmaalo in lagu sumeeyo kaydka DNS . Tani waxay noqon kartaa galitaanka qasabka ah ee shabakada kombuyuutarka si loo beddelo oo loo maamulo khasnadda DNC^(DNC) . Tani waxay noqon kartaa samaynta server DNS been abuur ah si jawaabaha been abuurka ah loo soo diro marka la waydiiyo. Waxaa jira siyaabo badan oo lagu sumeeyo kaydka DNS , mid ka mid ah siyaabaha caadiga ah waa DNS Cache Spoofing .

Akhri^(Read) : Sida loo ogaado in kombuyuutarkaaga DNS Settings la jabsaday addoo isticmaalaya ipconfig.

Kaydka DNS sunta - Ka-hortagga

Ma jiraan habab badan oo la heli karo si looga hortago sumowga DNS Cache . Habka ugu fiican ayaa ah in kor loo qaado nidaamyada amnigaaga^{(scale up your security systems)} si uusan weeraryahanna u waxyeelayn shabakadaada oo uu u maamulo khasnadda DNS^(DNS) ee deegaanka . Isticmaal dab- damis wanaagsan^{(good firewall)} kaas oo ogaan kara weerarrada sunta cache ee DNS . Nadiifinta kaydka DNS^{(Clearing the DNS cache)(Clearing the DNS cache)} si joogto ah sidoo kale waa ikhtiyaarka qaarkiin aad tixgelin karto.

Marka laga reebo kor u qaadista nidaamyada amniga, maamulayaashu waa inay cusboonaysiiyaan firmware-kooda iyo softiweerkooda^{(update their firmware and software)} si ay nidaamyada ammaanku u hayaan. Nidaamyada hawlgalka waa in lagu dhejiyaa cusbooneysiintii ugu dambeysay. Waa in aanu jirin xidhiidh ka baxaya dhinac saddexaad Server-ku waa in uu ahaado midka kaliya ee ka dhexeeya shabkada iyo internetka^(Internet) waana in uu ka dambeeyaa dab-damis wanaagsan.

Xidhiidhka aaminka ah ee server-yada^{(trust relations of servers)} shabakada waa in kor loo qaadaa si aanay u waydiisan wax server ah oo keliya xallinta DNS . Habkaas, kaliya server-yada leh shahaadooyin dhab ah ayaa awoodi doona inay la xiriiraan server-ka shabakada inta ay xallinayaan server-yada DNS .

Muddada gelista kasta ee kaydka ^(period)DNS waa in ay ahaataa mid gaaban si diiwaannada DNS loo soo qaado marar badan oo la cusboonaysiiyo. Tani waxay la macno noqon kartaa wakhti dheer oo lagu xidhidhinayo mareegaha (mararka qaarkood) laakiin waxay yaraynaysaa fursadaha isticmaalka kayd sumaysan.

Qufulka kaydka DNS^{(DNS Cache Locking)} waa in lagu habeeyaa 90% ama ka badan nidaamka Windows kaaga . Xiritaanka^(Cache) kaydinta ee Windows Server waxay kuu ogolaanaysaa inaad xakamayso in macluumaadka ku jira kaydka DNS dib loo qori karo iyo in kale. Ka eeg TechNet wax badan oo arrintan ku saabsan.

Adeegso barkada Socket-ka ee DNS^{(DNS Socket Pool)} maadaama ay awood u siiso server-ka DNS in uu isticmaalo randomization-ka isha marka la soo saarayo weydiimaha DNS . Tani waxay siinaysaa ammaan la xoojiyey oo lagaga hortagayo weerarrada sumowga ah, ayuu yidhi TechNet .

Magaca Domain System Security Extensions (DNSSEC)^{(Domain Name System Security Extensions (DNSSEC))} waa qayb kordhin loogu talagalay Windows Server -ka kaas oo ku dara amniga borotokoolka DNS . Waxaad wax badan oo arrintan ku saabsan ka akhriyi kartaa halkan^(here) .

Waxaa jira laba qalab oo laga yaabo inay ku xiiseeyaan^{(There are two tools that may interest you)} : F-Secure Router Checker wuxuu hubin doonaa afduubka DNS, iyo Qalabka Amniga ee WhiteHat wuxuu kormeeraa afduubyada DNS.

Hadda akhri: ^{(Now read:)} Waa maxay afduubka DNS^{(What is DNS Hijacking)} ?

U fiirsashada iyo faallooyinka waa la soo dhaweynayaa.^{(Observation and comments are welcome.)}

DNS Cache Poisoning and Spoofing - What is it?

DNS stands for Domain Name System, and this helps a browser in figuring out the IP address of a website so that it can load it on your computer. DNS cache is a file on your or your ISP’s computer that contains a list of IP addresses of regularly used websites. This article explains what is DNS cache poisoning and DNS spoofing.

DNS Cache Poisoning

Every time a user types a website URL in his or her browser, the browser contacts a local file (DNS Cache) to see if there is an entry to resolve the IP address of the website. The browser needs the IP address of the websites so that it can connect to the website. It cannot simply use the URL to directly connect to the website. It has to be resolved into a proper IPv4 or IPv6 IP address. If the record is there, the web browser will use it; else it will go to a DNS server to get the IP address. This is called DNS lookup.

A DNS cache is created on your computer or your ISP’s DNS server computer so that the amount of time spent in querying the DNS of a URL is reduced. Basically, DNS caches are small files that contain the IP address of different websites that are frequently used on a computer or network. Before contacting DNS servers, computers on a network contact the local server to see if there is an entry in the DNS cache. If there is one, the computers will use it; else the server will contact a DNS server and fetch the IP address. Then it will update the local DNS cache with the latest IP address for the website.

Each entry in a DNS cache has a time limit set, depending upon operating systems and the accuracy of DNS resolutions. After the period expires, the computer or server containing the DNS cache will contact the DNS server and update the entry so that the information is correct.
However, there are people who can poison the DNS cache for criminal activity.

Poisoning the cache means changing the real values of URLs. For example, cybercriminals can create a website that looks like say, xyz.com and enter its DNS record in your DNS cache. Thus, when you type xyz.com in the address bar of the browser, the latter will pick up the IP address of the fake website and take you there, instead of the real website. This is called Pharming. Using this method, cybercriminals can phish out your login credentials and other information such as card details, social security numbers, phone numbers, and more for identity theft. DNS poisoning is also done to inject malware into your computer or network. Once you land on a fake website using a poisoned DNS cache, the criminals can do anything they want.

Sometimes, instead of the local cache, criminals can also set up fake DNS servers so that when queried, they can give out fake IP addresses. This is high-level DNS poisoning and corrupts most of the DNS caches in a particular area thereby affecting many more users.

Read about: Comodo Secure DNS | OpenDNS | Google Public DNS | Yandex Secure DNS | Angel DNS.

DNS Cache Spoofing

DNS spoofing is a type of attack that involves impersonation of DNS server responses in order to introduce false information. In a spoofing attack, a malicious user attempts to guess that a DNS client or server has sent a DNS query and is waiting for a DNS response. A successful spoofing attack will insert a fake DNS response into the DNS server’s cache, a process known as cache poisoning. A spoofed DNS server has no way of verifying that DNS data is authentic, and will reply from its cache using the fake information.

DNS Cache Spoofing sounds similar to DNS Cache Poisoning, but there is a small difference. DNS Cache Spoofing is a set of methods used to poison a DNS cache. This could be a forced entry to a computer network’s server to modify and manipulate the DNC cache. This could be setting up a fake DNS server so that fake responses are sent out when queried. There are many ways to poison a DNS cache, and one of the common ways is DNS Cache Spoofing.

Read: How to find out if your computer’s DNS settings have been compromised using ipconfig.

DNS Cache Poisoning – Prevention

There are not many methods available to prevent DNS Cache poisoning. The best method is to scale up your security systems so that no attacker can compromise your network and manipulate the local DNS cache. Use a good firewall that can detect DNS cache poisoning attacks. Clearing the DNS cache frequently is also an option some of you may consider.

Other than scaling up security systems, admins should update their firmware and software to keep the security systems current. Operating systems should be patched with the latest updates. There should not be any third-party outgoing link. The server should be the only interface between the network and the Internet and should be behind a good firewall.

The trust relations of servers in the network should be moved up higher so that they do not ask just any server for DNS resolutions.  That way, only the servers with genuine certificates would be able to communicate with the network server while resolving DNS servers.

The period of each entry in the DNS cache should be short so that DNS records are fetched more frequently and are updated. This may mean longer time periods of connecting to websites (at times) but will reduce the chances of using a poisoned cache.

DNS Cache Locking should be configured to 90% or greater on your Windows system. Cache locking in Windows Server allows you to control whether or not information in the DNS cache can be overwritten. See TechNet for more on this.

Use the DNS Socket Pool as it enables a DNS server to use source port randomization when issuing DNS queries. This provides enhanced security against cache poisoning attacks, says TechNet.

Domain Name System Security Extensions (DNSSEC) is a suite of extensions for Windows Server that add security to the DNS protocol. You can read more about this here.

There are two tools that may interest you: F-Secure Router Checker will check for DNS hijacking, and WhiteHat Security Tool monitors DNS hijackings.

Now read: What is DNS Hijacking?

Observation and comments are welcome.

Related posts

• Hagaaji Farriinta Weerarka Sunta ah ee Cache ee la ogaaday

• Sida loo Nadiifiyo, Dib u Dajinta, U Daadi Cache DNS gudaha Windows 11/10

• Sida loo daadiyo oo dib loogu dejiyo khasnadda DNS ee Windows 10

• Sida loo nadiifiyo kaydka DNS ee Windows, Mac, Android iyo iOS

• Adeegyada Dynamic DNS ee ugu fiican ee shabakada ee ay tahay inaad isticmaasho

• Sida loo hagaajiyo Server-ka DNS oo aan ka jawaabin qalad

• DNSLookupView waa Qalabka Raadinta DNS ee bilaashka ah ee kumbuyuutarrada Windows

• 10ka Adeegayaasha DNS ee Dadweynaha ugu Fiican 2022: Isbarbardhigga & Dib u Eegista

• Dib u eegista OpenDNS - DNS bilaashka ah oo leh xakameynta iyo xawaaraha waalidka

• Sida Loo Awood & Habeeyo Duqowga & Waxyeelaynta DNS gudaha Serverka Windows

• Sida loo beddelo goobta server-ka DNS ee Xbox One si looga dhigo mid dhakhso badan

• Sida meelaha gaarka ah looga saaro Firefox DNS HTTPS

• [Fiddler] Raadinta DNS ee degelka oo ku guuldareystay system.net.sockets.socketexception

• Sida loo dejiyo Google Public DNS kumbuyuutarkaaga

• Server-kaaga DNS waxaa laga yaabaa inaan laga heli karin gudaha Windows 11/10

• Waa maxay weerarka afduubka DNS & sida looga hortago

• Khaladaadka HTTP 503, Adeeggu waa dhib aan la heli karin

• Aaladaha Raadinta DNS iyo adeegyada khadka ee bilaashka ah

• Sida loo xannibo mareegaha dadka waaweyn Windows 10 iyadoo la adeegsanayo Adeegyada DNS

• Sida loo habeeyo loona isticmaalo Cloudflare 1.1.1.1 ee Qoysaska