Tech Archives

Business has already made tremendous headway in using computers. This is shown by the following examples:

* Large banks now reportedly supply hardware and software to their customers so they can easily transfer funds to their suppliers.
* Airlines and trucking firms keep track of the location of their equipment and the airline reservation system facilitate travel arrangements through computer networks.
* Firms now have detailed personnel information incuding performance appraisals and carreer development plans – in a computerized data bank.

If the organization maintains a lot of files it would generate maximum staff efficiency and tremendous saving on cost in terms of paper, typewriter ribbons, and storage space, among other if it has its own database management system. A database is siply an organized collection of information, such as a list of names and adresses, sales and transactions, stock prices or even basketball scors. Even if you have already filled used quite a few databases. Think of a box or drawer filled with index cards in which you have written somebody’s name and address. The drawer or box is a database because it contains information. Rolodoxes, file cabinets, and library card catalog are other examples of common databses that you may have used.

A dabatase management system is a set of tools to help you manage a database. For example, when you add new cards to your box or drawer, or when you arrange the cards in alphabetical order to look up an address or therow away a card, you are managing a database. A database management system such as dbase3 or dbse 4 lets you perform these same managerial task: adding, changing, deleting, sorting, printing and looking yo unformation in a database.

Dbase, SQL, and other computerized databse management system do not store information on an index cards in a box or a drawer. Instead, each information is stored in database file on a computer disk. Each database file consists of records or rows of information in database files on a computer hard disk. Each record is divided into separate fields or columns of information.

Computers on the other hand cant tell a phone number from an address from a potato pancakes. Computer may be fast but they are difinitely not too bright. Therefore it is up for the operator or user to divide the information on his index cards or list of whatever databse is being stored into fields of information.

Incoming search terms:

  • bank data storage software
  • management data in computer
  • organizing computer files alphabetically
  • storage terms computer

DNS has a caching mechanism that is a temporary storage mapping between hostname and IP address after a name of server (NS) receives mapping information from other NS.

Incorrect data from the attacker host who plays the remote Name of Server (NS), which is stored in the DNS cache in victims Name of Server. To perform this attack, the attacker need to guess the necessary tricks to get some existing fields in the packet control, namely :
- Guessing destination port (with 65.535 possibility).
- Guessing DNS transaction ID (identification) which is in the packet of header control (with 65.535 possibility).
- Guessing hostname / domain name that is be queried by client.

Due to poor implementation of the resolver, port and transaction ID that is created by the client , which can also be easily predicted by an attacker. This happens on DNS security hole in Windows. The use of port and transaction ID is not random. This will make DNS spoofing easier to do especially if the attacker can conduct wiretaps on the network between the client and the DNS server.

Examples of this attack as follows :

1. An attacker create web pages that are similar with www.johndoe.com website, to be able to obtain usernames and passwords of customers. The hoax website is stored in a server with IP 202.2.2.1.

2. Attacker’s intent, if there is a host that uses a DNS server ns.target.com, http://www.johndoe.com will access the host, and it will do the request to the IP 202.2.2.1 which contains the hoax website of johndoe.com. Because the attacker has access to the network halo.com and can tap into the package that led to a name of server that is ns.halo.com and halo.com, the attacker perform DNS query type A, which asks the IP address of the xxx.halo.com to the name of server that will get attacked example ns.target.com.

3. If xxx.halo.com Host does not exist, the attacker only expect ns.target.com to ask ns.halo.com so that an attacker can tap into and see the detail of the DNS query packet. By looking at the details of DNS queries package that are intercepted from ns.target.com to ns.halo.com the attacker can predict the transaction ID that will be delivered by next ns.target.com.

4. Then the attacker sends the DNS query packet type A to ns.target.com, after that to host www.johndoe.com. The attacker expects ns.target.com will ask you about name of servers from johndoe.com, so that an attacker can use DNS reply to send deceptive (spoofed) that informs that www.johndoe.com has IP address 202.2.2.1.

5. If the transaction ID of the DNS reply has the same trick with the transaction ID of the DNS query that is sent from ns.target.com to johndoe.com with correct name of servers, and packet ns.target.com reply is received before actually answer package (the name of server from johndoe. com) comes then ns.target.com will update its cache database that has the IP address 202.2.2.1 for www.johndoe.com.

6. Now, anyone who uses a DNS server ns.target.com then when they browse to http://www.johndoe.com, they are directed to a hoax website located at 202.2.2.1.

Of course this process needs to be done with a tool so that the process can be done quickly and repeatedly with a successful assault becomes larger.

Incoming search terms:

  • dns cache poisoning
  • dns poisoning
  • cache poisoning
  • DNS cache poison
  • dns cache
  • dns cash poisoning
  • dns server
  • cache poison
  • images of DNS server
  • Poisoning DNS
DNS SPOOF

When we make a connection to a host / server by giving the host name, for example, you browse to http://www.google.com, the computer that we use will make the changes (translation) of the domain name www.google.com to IP addresses.

A TCP / IP network using IP addresses as an identifier of a host, the IP address is stored in each IP packet that carries data / information. With the IP, the switch / router can determine the path where the package should be sent.

The domain name used to facilitate us in remembering a host name. The process of translation done if the Domain Name System database used distributed TCP / IP applications to map between host names to IP addresses. The process called resolvable and resolvable will create a program to domain name that called the resolver.

The concept of control is specified in RFC 1034, while its implementation is described in RFC 1035. A host name is usually represented by a fully qualified domain name (FQDN), which has the form as follows:

- Host name like johndoe.blogspot.com, google.com, students.itb.ac.id are examples of FQDN.

Incoming search terms:

  • dns spoofing
  • Spoofing
  • IP spoofing
  • spoof
  • dns spoof
  • spoofing images
  • what is dns
  • DNS id spoofing
  • spoof pics
  • spoofing example