DNS, DHCP & IP Address Management appliances
For Microsoft DNS & DHCP servers
For open source DNS & DHCP servers
Manage multi-vendor cloud DNS servers centrally
RIR Declaration Management and Automation
Automated network device configuration and management
Centralized visibility over all your clouds
A single source of truth for your network automation
It’s much easier to remember a meaningful name than a meaningless IP address
Carrier-grade DNS DDoS attack protection
Protect users and block DNS-based malware activity
Adaptive DNS security for service continuity and data protection
Improve Application Access Control to prevent spread of attacks
Optimize application delivery performance from the edge
Working from anywhere needs DNS security
Visibility, analytics and micro segmentation for effective Zero Trust strategy
Enable work from anywhere by controlling access, security and data privacy
Simplify management and control costs across AWS, Azure and GCP environments
Risk-free migration to reduce DDI complexity and cost
Move risk-free to improve performance, security and costs
Automate management, unify control and strengthen security of connected devices
Protect your network against all DNS attacks, data exfiltration and ransomware
Enable zero touch operations for network management and security
Improve resiliency, deployment velocity and user experience for SD-WAN projects
Integrated DNS, DHCP, IPAM services to simplify, automate and secure your network.
Simplify design, deployment and mgmt of critical DDI services for telcos
Simplify and automate management of critical DDI services for finance
Simplify and automate management of critical DDI services for higher education
Simplify and automate management of critical DDI services for retail
Open architecture for DDI integration
Technology partnerships for network security & management ecosystems
Extend security perimeters and strengthen network defenses
Submit requests for temporary licenses
Submit access requests for EfficientIP knowledge platforms
Submit membership requests for EfficientIP Community
We integrate DDI, DNS Security and intelligent app traffic management
Customer-centric DDI project delivery and training
Acquire the skills needed to manage EfficientIP SOLIDserver™
Identify vulnerabilities with an assessment of your DNS traffic
Test your protection against data breaches via DNS
Dedicated representation for your organization inside EfficientIP
Explore content which helps manage and automate your network and cloud operations
Read content which strengthens protection of your network, apps, users and data
Learn how to enhance your app delivery performance to improve resilience and UX
Why Using DNS Allow Lists is a No-Brainer
Applications and Infrastructures must be approached in terms of life-cycle
Who we are and what we do
Meet the team of leaders guiding our global growth
Technology partnerships for network security and management ecosystems
Discover the benefits of the SmartPartner global channel program
Become a part of the innovation
The latest updates, release information, and global events
Extend Your Enterprise Security Perimeter
July 24, 2018 | EfficientIP | DHCP, DNS Security
Recent disclosure of a paper describing an attack (aLTEr) against LTE networks titled “Breaking LTE on Layer Two” is surprisingly drawing a lot of attention to DNS security over mobile networks. The fact is, this paper refers to a combination of multiple “vulnerabilities” within the implementation of LTE networks. It describes how it’s possible to corrupt mobile network traffic, by targeting, as an example, DNS packets. But beware- any unencrypted protocol is at risk. In the end, this alarming paper highlights the well known fact that since the inception of DNS, DNS traffic between a client and its DNS resolver is unsecured. The reason is that related traffic is neither authenticated nor encrypted, leaving the integrity of the transaction at risk.
Overview of the DNS redirection attack: A malicious relay is deployed as a Man in the Middle between the UE (User Equipment) and the commercial network, which alters the destination IP address of a DNS request to redirect messages to a malicious DNS server. Eventually, the UE connects to the malicious HTTP server.
Image source: Breaking LTE Layer Two publication
As a result, many telecommunication network operators are expressing concerns about DNS security, and are now asking for the rapid deployment of DNS security mechanisms. This concern is a good thing, however. Being aware that deploying DNS over TLS or an equivalent protocol will take time. DNS clients (mostly operating systems) are not yet compatible, hence deployment considerations are numerous. For instance, very few operating systems natively support this protocol, and those which do provide very limited support. More importantly, other alternatives are still on the table since DNS over TLS may significantly impact DNS performance and DNS scaling. Switching the underlying transport protocol from UDP to TCP brings new limitations and challenges (increase in consumed bandwidth, limited number of TCP concurrent sessions, etc.). These potential issues could possibly be addressed by deploying DNS over DTLS or QUIC, for instance.
For now, some actors are pushing for DNS over TLS. Google is announcing DNS over TLS support within the next Android version, Pistachio. This might push for a massive deployment of this protocol, but only if network operators agree on deploying the necessary network infrastructure instead of waiting for other alternatives such as DNS over DTLS or QUIC, which remain drafts at the IETF (see here and here).
For additional information regarding Breaking LTE on Layer Two, see here, ‘alter attack’ website and a video demo here. Also, for earlier work discussing security issues with LTE please see here.
Take action and protect your network.Download the DNS security best practices white paper to learn how.
Tags: DNSDNS over TLSDNS securityDNS security best practicesTransport
When our goal is to help companies face the challenges of modern infrastructures and digital transformation, actions speak louder than words.
Explore content highlighting the value EfficientIP solutions bring to your network