DNS sinkhole: Difference between revisions
→Applications: Added secondary source (copied from the Pi-hole article). |
→Applications: Undoing changes done by anonymous proxy or VPN IP address 185.213.154.168 |
||
| Line 15: | Line 15: | ||
Sinkholes can be used both constructively, as has been done for the containment of the [[WannaCry cyber attack|WannaCry]] and [[Avalanche (phishing group)|Avalanche]] threats,<ref>{{cite web|url=https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168|title=Wannacrypt0r-FACTSHEET.md|first=|last=262588213843476|website=Gist}}</ref> and destructively, for example disrupting DNS services in a [[Denial-of-service attack|DoS]] attack. |
Sinkholes can be used both constructively, as has been done for the containment of the [[WannaCry cyber attack|WannaCry]] and [[Avalanche (phishing group)|Avalanche]] threats,<ref>{{cite web|url=https://gist.github.com/rain-1/989428fa5504f378b993ee6efbc0b168|title=Wannacrypt0r-FACTSHEET.md|first=|last=262588213843476|website=Gist}}</ref> and destructively, for example disrupting DNS services in a [[Denial-of-service attack|DoS]] attack. |
||
One use is to stop [[botnet]]s, by interrupting the DNS names the botnet is programmed to use for coordination. The most common use of a hosts file-based sinkhole is to block [[ad serving|ad serving sites]].<ref name="Hosts based ad block">{{cite news | first=someonewhocares.org | title=How to make the Internet not suck (as much) | author=Dan Pollock | date=October 11, 2012 | url=http://someonewhocares.org/hosts/ | access-date=October 12, 2012}}</ref> Ad serving can also be blocked (e.g., using [[Pi-hole]]) using a locally running DNS server on your computer or on your local network effectively blocking Ads for all devices on the network.<ref>{{Cite news|url=https://www.lifehacker.com.au/2015/02/turn-a-raspberry-pi-into-an-ad-blocker-with-a-single-command/|title=Turn A Raspberry Pi Into An Ad Blocker With A Single Command|date=2015-02-17|work=Lifehacker Australia|access-date=2018-05-06|language=en}}</ref> |
One use is to stop [[botnet]]s, by interrupting the DNS names the botnet is programmed to use for coordination. The most common use of a hosts file-based sinkhole is to block [[ad serving|ad serving sites]].<ref name="Hosts based ad block">{{cite news | first=someonewhocares.org | title=How to make the Internet not suck (as much) | author=Dan Pollock | date=October 11, 2012 | url=http://someonewhocares.org/hosts/ | access-date=October 12, 2012}}</ref> Ad serving can also be blocked (e.g., using [[Pi-hole]] or Technitium DNS Server) using a locally running DNS server on your computer or on your local network effectively blocking Ads for all devices on the network.<ref>{{Cite news|url=https://www.lifehacker.com.au/2015/02/turn-a-raspberry-pi-into-an-ad-blocker-with-a-single-command/|title=Turn A Raspberry Pi Into An Ad Blocker With A Single Command|date=2015-02-17|work=Lifehacker Australia|access-date=2018-05-06|language=en}}</ref><ref name="Blocking Internet Ads Using DNS Sinkhole">{{cite web|url=https://blog.technitium.com/2018/10/blocking-internet-ads-using-dns-sinkhole.html|title=Blocking Internet Ads Using DNS Sinkhole|first=Shreyas|last=Zare|publisher=}}</ref> |
||
==References== |
==References== |
||
Revision as of 10:39, 2 October 2019
A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS[1] is a DNS server that gives out false information[clarification needed], to prevent the use of a domain name.
Operation
A sinkhole is a DNS provider that supplies systems looking for DNS information with false results, allowing an attacker to redirect a system to a potentially malicious destination. DNS sinkholes have also historically been used for non-malicious purposes.
When a computer visits a DNS source to resolve a domain name, the provider will give a result if possible, and if not, it will send the resolution system to a higher-level provider to try again. The higher a DNS Sinkhole is in this chain, the more requests it will receive, the more beneficial effect it will provide.
Network-level disabling
A sinkhole is a standard DNS server that has been configured to hand out non-routable addresses for all domains in the sinkhole, so that every computer that uses it will fail to get access to the real website.[2] The higher up the DNS resolution chain the sinkhole is, the more requests it will block as it will supply answers to a greater number of lower NS servers that in turn will serve a greater number of clients. Some of the larger botnets have been made unusable by TLD sinkholes that span the entire Internet.[3] DNS Sinkholes are effective at detecting and blocking malicious traffic, and are used to combat bots and other unwanted traffic.
Host-level disabling
By default, the local hosts file on a Microsoft Windows, Unix or Linux computer is checked before DNS servers, and can also be used to block sites in the same way.
Applications
Sinkholes can be used both constructively, as has been done for the containment of the WannaCry and Avalanche threats,[4] and destructively, for example disrupting DNS services in a DoS attack.
One use is to stop botnets, by interrupting the DNS names the botnet is programmed to use for coordination. The most common use of a hosts file-based sinkhole is to block ad serving sites.[5] Ad serving can also be blocked (e.g., using Pi-hole or Technitium DNS Server) using a locally running DNS server on your computer or on your local network effectively blocking Ads for all devices on the network.[6][7]
References
- ^ kevross33, pfsense.org (November 22, 2011). "BlackholeDNS: Anyone tried it with pfsense?". Retrieved October 12, 2012.
{{cite news}}: CS1 maint: numeric names: authors list (link) - ^ Kelly Jackson Higgins, sans.org (October 2, 2012). "DNS Sinkhole - SANS Institute". Retrieved October 12, 2012.
- ^ Kelly Jackson Higgins, darkreading.com (October 2, 2012). "Microsoft Hands Off Nitol Botnet Sinkhole Operation To Chinese CERT". Retrieved September 2, 2015.
- ^ 262588213843476. "Wannacrypt0r-FACTSHEET.md". Gist.
{{cite web}}:|last=has numeric name (help) - ^ Dan Pollock, someonewhocares.org (October 11, 2012). "How to make the Internet not suck (as much)". Retrieved October 12, 2012.
- ^ "Turn A Raspberry Pi Into An Ad Blocker With A Single Command". Lifehacker Australia. 2015-02-17. Retrieved 2018-05-06.
- ^ Zare, Shreyas. "Blocking Internet Ads Using DNS Sinkhole".
 | This Internet domain name article is a stub. You can help Wikipedia by expanding it. |