Let's say we got an up to date platform.
If the DNS credentials provided by your ISP/MNO are compromised by hijacking (NetBIOS overwritten) it may helps to compare the e.g. financial institution ebanking IP has previously been stored to check. But at the current state if the internet connection is running how to detect the DNS hijacking? On e.g. RIPE rDNS or pre-delegated domains can be checked but too complicated for ordinary users.
What should a user do to check DNS hijacking before he/she provides login credentials including OTPs in a compromised but perfect similar looking fake site?
An easy way to check must be found for non-forensics profs.
This question and thread seems to have gone off the rails.
First off DNS responses are not credentials.
"NetBIOS overwritten" is a complete non sequitur. ?
"… compare the e.g. financial institution ebanking IP …" flys in the face of how the Internet works. IP addresses are not credentials either.
"…before he/she provides login credentials …" needs some kind of security mechanism that can be verified, ideally automatically, if a site is real or fake. It could be a cryptographically signed credential verified by trusted authorities signing the identifier. Signatures by untrusted authorities would be blocked or flagged. We could call it a Cert for short.
Better yet, we could just put an "S" on the end of HTTP.
If this was an attempt to discuss DNSsec, the horse died at the gate.
The horse got recovered and is alive. Lets put aside that ordinary users can protect against DNS Hijacking. Where is to find a public history of DNS hijacking to investigate (this is forensics) an eBanking fraud back to the event date?
… and just to introduce some added complication …
… let's talk of eTLS/ETS, i.e. "quasi-TLS" 😯
https://
In a nutshell wink
Instead of thinking of this as “Enterprise Transport Security,” which the creators say the acronym stands for, you should think of it as “Extra Terrible Security.”
jaclaz
Where is to find a public history of DNS hijacking?
Where is to find a public history of DNS hijacking?
A possible starting point
http//
jaclaz
Page not found