DNSMasq Vulnerability Enables DDoS Attacks

When you’re learning to speak a new language, the first thing you do when you hear a sentence spoken is to try and translate it back into your first language. That’s a bit like the way that the Domain Name System (DNS), a decentralized and hierarchical naming system for internet and network-connected computers, operates.

It functions as a database of sorts, turning the web addresses users type into a browser (such as www.thisisawebsite.org) into the Internet Protocol or “IP” address (such as 196.211.662.240) that the computer needs in order to know where to direct your query.

It’s not difficult to see why that’s an important job. Few people in 2021 can (or need to) remember the cell number of their closest family members, let alone rattle off the string of digits they’d need to access their most-used websites if they were unable to enter their names as usual.

Although the DNS lookup process involves multiple steps and a fair amount of behind-the-scenes complexity, users don’t have to do anything more than type an address and hit enter, with the website loading instantly. However, if something went wrong, it would be disastrous. Those without the proper information security systems in place could quickly find themselves in trouble.

IMAGE: UNSPLASH

Be Aware Of Vulnerabilities

This is where potential vulnerabilities enter the picture. Imagine, for example, that you entered www.gmail.com into your browser’s search bar but, instead of loading the legitimate Google email system, you were instead redirected to another website. The secondary website could show the normal gmail.com address in the address bar, and may be designed to look like the regular Gmail login page, as a “phishing” means of getting users to enter their personal information so it can be stolen.

This is called DNS cache poisoning. It refers to the entering of incorrect information into a DNS cache (the temporary information store about previous DNS lookups that are kept on a computer’s operating system or in its web browser) so that DNS queries come back with the wrong response and send users to the incorrect websites as a result. This is also sometimes referred to as DNS spoofing. It exploits potential DNS vulnerabilities and could be used for a variety of malicious purposes.

Early in 2021, a series of seven flaws were discovered in DNSMasq, a DNS forwarder and Dynamic Host Configuration Protocol (DHCP) server used in a variety of routers, phones, and assorted other network devices. Three of these vulnerabilities made possible DNS cache poisoning, while four related to buffer overflow vulnerabilities, in which programs are given too much data, resulting in serious errors. Buffer overflows can be used to overwrite data, trigger network crashes, or to replace memory with altered code.

DNSpooq Strikes

These seven vulnerabilities, which were nicknamed “DNSpooq,” were described as having limited impact individually. However, when chained together they could be extremely harmful in their consequences, potentially resulting in device takeovers on the part of cyber attackers, which may be used for fraudulent purposes. They could also be utilized as part of a mass routing of traffic to wage enormous distributed denial-of-service (DDoS) attacks against targets.

These attacks involve the use of botnets, consisting of thousands of “zombie” computers, to bombard victims with massive amounts of fake traffic in order to bring down online services or websites.

The DNSMasq vulnerabilities were quickly patched. But as with any patches these rely on users installing the fixes in order for them to be effective. That’s sometimes easier said than done — especially when it comes to users unaware of the potential importance of DNS spoofing.

Protecting against these attacks is incredibly important. The first line of defense organizations should use involves keeping their software up to date. But this may not always be enough. Keeping software up to date is a time-intensive process. It also relies upon software developers being made aware of vulnerabilities and patching these in a timely manner. It doesn’t protect against zero day exploits, which involve flaws that have not yet been disclosed to developers.

Defend Yourself At All Times

For comprehensive protection, organizations should consider utilizing the latest cybersecurity systems. DNS server protection adds an extra layer of protection that sits between users and the internet. It works by blacklisting websites considered dangerous and blocking illegal DNS queries from reaching your server.

These tools can also mask servers from direct-to-IP network layer attacks. Another valuable line of protection involves anti-DDoS measures, which can block DDoS attacks of any size, as well as filtering out bad traffic while allowing legitimate requests to get through.

If you’re serious about defending against all types of cyberattacks (which any organization should be), seek out the right cybersecurity experts for advice. It’s a lot less costly than waiting for the worst-case scenario to happen involving attackers.

If you are interested in even more technology-related articles and information from us here at Bit Rebels, then we have a lot to choose from.

IMAGE: UNSPLASH