![Black Hat Briefings, USA 2007 [Video] Presentations from the security conference. artwork](https://is2-ssl.mzstatic.com/image/thumb/Podcasts/v4/72/67/63/726763f4-d563-024c-5880-49dcaabf2fb4/mza_7096284172862428647.jpg/100x100bb.jpg)
Jerry Schneider: Reflection DNS Poisoning
Black Hat Briefings, USA 2007 [Video] Presentations from the security conference.
English - January 09, 2006 23:10 - 19 minutes - 34.9 KB Video - ★★★★★ - 1 ratingTechnology News Tech News blackhat usa 2006 black hat vegas blackhat vegas hacking convention computer security speeches presentations spoken word video Homepage Download Apple Podcasts Google Podcasts Overcast Castro Pocket Casts RSS feed
Targeting an enterprise attack at just a few employees seems to be yielding the best results, since it lowers the risk of discovering the exploit. Yet the typical DNS cache poisoning approach, aimed at various levels in the DNS server hierarchy or the enterprise server itself, is not as effective as it could be, primarily because so many people are affected that detection is rapid...
There is one approach to DNS cache poisoning that can control the attack surface and is particularly effective when executed from within the enterprise. Rather than attempting to poison the enterprise DNS server or other external caches, the internal DNS cache within a Windows PC is targeted. Additionally, forensic analysis of the infected PC is hindered by the TimeToLive and volatility of these cache entries.
I will demonstrate this type of attack using two machines on a local lan, and include some analysis of the firewall and configuration issues needed to defend against this type of exploit.