Definitely Not Secure (DNS): DNS Attacks, Tools, and Defenses | Matt Scheurer | BSides312 2026

In a cybersecurity world always hyper-focused on "the new hotness," why is that vanity protocol making internet addressing human-friendly so often overlooked? Everybody attending BSides uses the Domain Name System (DNS), and daily, but relatively few understand how it all works. Yet the security ramifications are huge! After physical access, those who control the flow of network packets win. This holds true for offensive security practitioners, tech defenders, and threat actors alike. This super fun and entertaining talk features live demos covering DNS basics, DNS tools, DNS security, and DNS attacks. --- About Matt Scheurer: InfoSec Rock Star at ThreatReel Podcast Matt Scheurer is VP of Computer Security & Incident Response in a large enterprise environment. He continues to be a leading voice in the InfoSec community through podcasts, live demos, and community outreach. Matt has presented numerous Information Security topics at countless technology meetup groups, and prominent Information Security conferences all across the country. Matt has delivered keynote addresses at several conferences, and received multiple industry awards. Recorded live at BSides312 2026. --- Chapters: 0:00 Introduction 0:55 Hacking Is Not a Crime 1:20 Why I Care How We Teach Security 2:45 The S Doesn't Stand for Security 3:05 DNS Gossips: It Will Tell On You 3:50 DNS and the OSI Model 4:35 UDP 53, Size Limits, and Zone Transfers 5:30 DNS over TLS and HTTPS 6:25 Records: A and AAAA 7:20 CNAME as a Substitution Record 7:50 TXT Records, Verification, and SPF 9:10 MX, NS, and SOA 10:05 PTR and SRV 11:00 RFC 1035 and the 255-Character Limit 11:55 TTL: The Tradeoff Most Places Get Wrong 13:30 Tools: nslookup and dig 15:35 Early DNS Security Woes: RFC 1535, 1993 16:30 Inherent Weaknesses: UDP Is Plaintext 17:25 Demo: Watching DNS in Wireshark 18:20 Pinging MySpace in 2026 20:10 DNS Hijacking and the Resolution Path 21:05 DNS Search Path and NetBIOS 22:00 "But Surely DNSSEC Solves This" 22:30 Complexity Is the Enemy of Security 23:50 Typosquatting 24:45 You Can Put DNSSEC on Your Typosquat Too 25:00 The Hosts File 25:40 Demo: Injecting the Hosts File 27:45 Why This Bypasses DNSSEC Entirely 28:25 Rogue DHCP and the DORA Process 30:15 NetBIOS and WINS in Old Environments 31:00 DNS Tunneling 32:05 Demo: Command and Control Over TXT Records 32:30 Recognizing Base64 by Its Padding 34:50 CyberChef and Intensive Mode 36:40 The Hidden Command: Disabling the Windows Firewall 38:30 Base64 Plus XOR With Key 42 38:45 Demo: Exfiltration 40:00 ARP Spoofing and Registrar Takeover 40:50 Amplification Attacks 41:40 Reflection Attacks 43:05 Q&A --- Mentioned in this talk: - nslookup and dig - Wireshark - CyberChef - RFC 1035 - RFC 1535 - DNSSEC Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw