DetailedCAPEC-589
CAPEC-589: DNS Blocking
Description
An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- This attack requires the ability to conduct deep packet inspection with an In-Path device that can drop the targeted traffic and/or connection.
Consequences
- Availability
Other
Preventing DNS from resolving a request denies the availability of a target site or service for the user.
Mitigations
- Hard Coded Alternate DNS server in applications
- Avoid dependence on DNS
- Include hosts file/IP address in the application.
- Ensure best practices with respect to communications channel protections.
- Use a .onion domain with Tor support