COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-589

DNS Blocking

An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Other

Etkilenen alanlar: Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Hard Coded Alternate DNS server in applications
2
Avoid dependence on DNS
3
Include "hosts file"/IP address in the application.
4
Ensure best practices with respect to communications channel protections.
5
Use a .onion domain with Tor support

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
Full URL Based Filtering: Filtering based upon the requested URL. URL String-based Filtering: Filtering based upon the use of particular strings included in the requested URL.
CAPEC-589: DNS Blocking — DayBreach Saldırı Sözlüğü · DayBreach