1. Pharming Group 10: Phuc H. Dao Anita Lugonja

2. Motivation To give students an opportunity to learn about DNS poisoning To give students an opportunity to learn about DNS poisoning To give students hand-on experience with host files and DNS configuration To give students hand-on experience with host files and DNS configuration

3. Agenda Host Files Host Files DNS DNS The Art of Pharming The Art of Pharming Demo Demo

4. Host Files Static Naming Resolution Static Naming Resolution

5. DNS Domain Name System Domain Name System Naming Hierarchy Naming Hierarchy

6. Managed by GT DNS Name hierarchy DNS hierarchy can be represented by a tree DNS hierarchy can be represented by a tree Root and top-level domains are administered by an Internet central name registration authority (ICANN) Root and top-level domains are administered by an Internet central name registration authority (ICANN) Below top-level domain, administration of name space is delegated to organizations Below top-level domain, administration of name space is delegated to organizations Each organization can delegate further Each organization can delegate further Managed by ECE Dept. “Domain Name System.”

7. Domain name system Each node in the DNS tree represents a DNS name Each node in the DNS tree represents a DNS name Each branch below a node is a DNS domain. Each branch below a node is a DNS domain. DNS domain can contain hosts or other domains (subdomains) DNS domain can contain hosts or other domains (subdomains) Example: DNS domains are., edu, gatech.edu, cc.gatech.edu Example: DNS domains are., edu, gatech.edu, cc.gatech.edu “Domain Name System.”

8. Hierarchy of name servers The resolution of the hierarchical name space is done by a hierarchy of name servers The resolution of the hierarchical name space is done by a hierarchy of name servers Each server is responsible (authoritative) for a contiguous portion of the DNS namespace, called a zone. Each server is responsible (authoritative) for a contiguous portion of the DNS namespace, called a zone. Zone is a part of the subtree Zone is a part of the subtree DNS server answers queries about hosts in its zone DNS server answers queries about hosts in its zone “Domain Name System.”

9. DNS domain and zones Each zone is anchored at a specific domain node, but zones are not domains. Each zone is anchored at a specific domain node, but zones are not domains. A DNS domain is a branch of the namespace A DNS domain is a branch of the namespace A zone is a portion of the DNS namespace generally stored in a file (It could consists of multiple nodes) A zone is a portion of the DNS namespace generally stored in a file (It could consists of multiple nodes) A server can divide part of its zone and delegate it to other servers A server can divide part of its zone and delegate it to other servers “Domain Name System.”

10. Lab Requirements Windows XP Windows XP RedHat 4.0 RedHat 4.0 DNS server DNS server

11. Let’s Poison Host File manipulation Host File manipulation cnn.comgoogle.com www.google.com 207.68.172.246 google.com www.google.com

12. DNS Poison There is one more DNS concept to learn There is one more DNS concept to learn

13. Resolver and name server 1. An application program on a host accesses the domain system through a DNS client, called the resolver 2. Resolver contacts DNS server, called name server 3. DNS server returns IP address to resolver which passes the IP address to application Reverse lookups are also possible, i.e., find the hostname given an IP address Reverse lookups are also possible, i.e., find the hostname given an IP address “Domain Name System” “Domain Name System”

14. Resolver Configuration File /etc/nsswitch.conf needs to contain the line File /etc/nsswitch.conf needs to contain the line hosts: dns files hosts: dns files Add this line to /etc/resolv.conf Add this line to /etc/resolv.conf nameserver nameserverIPAddress

15. Named.conf Pointer to the new zone Pointer to the new zone zone "mit.edu" IN { type master; file "mit.edu.zone"; allow-update{none;};};

16. Create an zone Next Slide Next Slide

18. Result

20. Lab Scenarios Host File and DNS Concept Host File and DNS Concept Host File Poisoning Host File Poisoning DNS Poisoning DNS Poisoning Ethereal Capture of DNS traffic Ethereal Capture of DNS traffic After Lab2 and incorporated with other team’s pharming lab After Lab2 and incorporated with other team’s pharming lab

21. Sources Liebeherr, Jorg. Zarki, Magda El. Mastering Networks: An Internet Lab Manual.New York. 2004. Liebeherr, Jorg. Zarki, Magda El. Mastering Networks: An Internet Lab Manual.New York. 2004. “Domain Name System.” Masterin Networks – Lecture Notes. 11 April 2007. “Domain Name System.” Masterin Networks – Lecture Notes. 11 April 2007. http://www.cs.virginia.edu/~itlab/b ook/slides/index.htmlhttp://www.cs.virginia.edu/~itlab/b ook/slides/index.html

22. Questions? Questions?