, Vulnerability Analyst at Dragos, Inc.
This is three talks in one, as we look at several issues with DNS that affect control systems.
First we look at DNS squatting, which affects many ICS vendors. Then we look at two DNS issues that we frequently see on deployed control systems.
I plan to put a graphical representation of a DNS request here.
I will talk about how the names looked up are some encoded in Unicode (foreign character sets), so Wireshark (a software tool for displaying packets) does not display the queries correctly.
This is a graphic showing how to stop DNS tunneling. The hexagon shows to forward the corporate request to the corporate network, but to reject requests for any external servers.