Digest
- DNSSEC strengthens authentication in DNS using digital signatures based on public key cryptography.
- Every DNS zone has a public/private key pair. The zone owner uses the zone’s private key to sign DNS data in the zone and generate digital signatures over that data.
- The zone’s public key, however, is published in the zone itself for anyone to retrieve.
- Recursive resolvers cache the DNS data they receive from authoritative name servers to speed up the resolution process.
- This reliance on caching has a downside, however: if an attacker sends a forged DNS response that is accepted by a recursive resolver, the attacker has poisoned the cache of the recursive resolver. The resolver will then proceed to return the fraudulent DNS data to other devices that query for it.
Source: DNSSEC – What Is It and Why Is It Important?
Example
As an example of the threat posed by a cache-poisoning attack, consider what happens when a user visits their bank’s website. The user’s device queries its configured recursive name server for the bank web site’s IP address. But an attacker could have poisoned the resolver with an IP address that points not to the legitimate site but to a web site created by the attacker. This fraudulent website impersonates the bank website and looks just the same. The unknowing user would enter their name and password, as usual. Unfortunately, the user has inadvertently providing their banking credentials to the attacker, who could then log in as that user at the legitimate bank web site to transfer funds or take other unauthorized actions.
Source: DNSSEC – What Is It and Why Is It Important?