Secure Self-Hacking For Vulnerability Detection

As the foundation of all networks and IP-based services and ventures, DNS (Domain Name System) represents a popular target for cyber criminals to penetrate a network, exploit vulnerabilities and exfiltrate critical data for malicious purposes. A study conducted in partnership with research firm IDC revealed that 88 percent of respondents had experienced at least one DNS attack on their organization during a 12-month period, with nearly a quarter experiencing theft of sensitive customer data or intellectual property via DNS.

Ethical hacks on DNS systems

The new DNS-based Data Exfiltration Application EfficientIP is available free of charge to partners and enterprises. The online tool enables companies to easily and securely perform their own ‘ethical hack’ of their DNS systems and associated security measures. In this way, vulnerabilities can be uncovered that could lead to a major security breach in the network and, consequently, a data leak.

EfficientIP’s DNS-based Data Exfiltration Application allows organizations to test their own DNS networks with their own ‘ethical hack’. The free online tool can be used to uncover vulnerabilities that could lead to a major security breach in the network and, in turn, a data leak. In data exfiltration, which uses similar techniques to DNS tunneling, the attackers take what is known as a “low-and-slow” approach. The attackers pay attention not to cause a sharp increase in DNS traffic and not to attract attention. In this approach, they extract smaller data packets via legitimate DNS requests to the server and reconstruct the information once this process is complete.

Attack vectors are difficult to identify

“Data exfiltration via DNS is one of the most complex and difficult attack vectors to identify, but it can cause significant damage to companies. It is difficult to detect even to the trained human eye, and because many of the traditional security solutions are unable to detect exfiltration in legitimate traffic and DNS requests, companies can be affected by a data breach long before they are aware of it,” said Norman Girard, CEO of EfficientIP.