COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-589

DNS Blocking

An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.

Requirements

What does the attack require?

Prerequisites

  • This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Other

Affected scopes: Availability

Defence

How is it prevented and mitigated?

1
Hard Coded Alternate DNS server in applications
2
Avoid dependence on DNS
3
Include "hosts file"/IP address in the application.
4
Ensure best practices with respect to communications channel protections.
5
Use a .onion domain with Tor support

Real world

MITRE example instances

Example instance 1Detail
Full URL Based Filtering: Filtering based upon the requested URL. URL String-based Filtering: Filtering based upon the use of particular strings included in the requested URL.
CAPEC-589: DNS Blocking — DayBreach Saldırı Sözlüğü · DayBreach