DEV Community: Marek „Netbe” Lampart

DNS Security: Why Your Domain Configuration Can Become a Cybersecurity Problem

Marek „Netbe” Lampart — Tue, 07 Jul 2026 16:22:41 +0000

When people think about cybersecurity, they usually focus on passwords, malware, vulnerabilities, and firewalls.

DNS is rarely the first thing that comes to mind.

However, DNS is one of the most important components of modern infrastructure. Almost every web application, API, email system, and cloud service depends on correct DNS configuration.

A small DNS mistake can create serious security problems.

What is DNS and why does it matter?

DNS (Domain Name System) translates human-readable domain names into IP addresses.

Instead of remembering:

142.250.xxx.xxx

users can access:

example.com

But DNS does more than just resolve domains.

It also tells the internet:

where your website is hosted,
where your email servers are located,
which services exist,
which external providers are trusted.

Because of this, DNS becomes part of your security perimeter.

Common DNS security problems

1. Forgotten subdomains

One of the most common problems is abandoned subdomains.

Example:

dev.example.com
test.example.com
old.example.com

A company may stop using a service but leave the DNS record behind.

If that service is removed but the DNS entry remains, attackers may attempt a subdomain takeover.

The problem is simple:

DNS says:

dev.example.com → external-service.com

but nobody controls that external resource anymore.

2. Missing SPF, DKIM and DMARC records

Email security heavily depends on DNS.

Without proper email authentication, attackers can spoof your domain.

Common protections:

SPF

Defines which servers can send email for your domain.

Example:

example.com TXT

v=spf1 include:_spf.google.com ~all

DKIM

Adds cryptographic signatures to emails.

DMARC

Defines what receivers should do when SPF or DKIM checks fail.

Example:

_dmarc.example.com TXT

v=DMARC1; p=quarantine

These mechanisms do not stop every phishing attempt, but they significantly improve domain protection.

3. Exposed internal information

DNS records can reveal information about infrastructure.

Examples:

vpn.example.com
admin.example.com
backup.example.com
dev.example.com

This does not automatically mean a vulnerability exists.

However, attackers use DNS information during reconnaissance.

Before attacking systems, they first try to understand the environment.

4. Weak DNS configuration

Common configuration mistakes:

outdated nameservers,
missing DNSSEC,
incorrect TTL values,
forgotten records,
publicly exposed development environments.

A domain can work perfectly and still have security problems.

DNSSEC - protecting DNS integrity

DNS itself was not originally designed with strong authentication.

DNSSEC adds cryptographic verification to DNS responses.

It helps protect against attacks where someone tries to modify DNS responses and redirect users somewhere else.

DNSSEC does not encrypt DNS traffic.

Its purpose is integrity and authenticity.

How to perform a basic DNS security audit

A simple audit should check:

Domain records

Review:

A records
AAAA records
MX records
NS records
TXT records

Email protection

Verify:

SPF
DKIM
DMARC

Old resources

Look for:

unused subdomains,
forgotten services,
old cloud resources.

Nameserver security

Check:

provider reliability,
DNSSEC support,
account protection.

Useful tools for DNS analysis

Some commonly used tools:

dig

Linux users can query DNS directly:

dig example.com

Check MX records:

dig MX example.com

Check TXT records:

dig TXT example.com

nslookup

A simpler alternative:

nslookup example.com

Online DNS checkers

Online tools are useful for quick verification:

DNS record lookup
MX verification
SPF checking
propagation testing

DNS is often forgotten security layer

Many organizations invest heavily in:

endpoint protection,
firewalls,
monitoring,
vulnerability scanners.

But DNS configuration is often treated as "just networking".

That is a mistake.

DNS controls how users and systems find your services.

If DNS is wrong, everything built on top of it can become unreliable or unsafe.

Final thoughts

Security is not only about preventing attacks.

It is also about reducing unnecessary exposure.

A properly configured DNS environment:

reduces attack surface,
improves email security,
prevents accidental exposure,
makes infrastructure easier to manage.

DNS may look simple from the outside, but it is one of the foundations of modern cybersecurity.

Author

Marek "Netbe" Lampart

Cybersecurity | Linux | Networking | Infrastructure Security

https://netbe.pl

Ransomware explained: how modern attacks really work in 2026 (not theory)

Marek „Netbe” Lampart — Sun, 05 Jul 2026 15:09:19 +0000

Ransomware is often explained in a very simple way:

“It encrypts your files and demands payment.”

That description is technically correct — but it hides how complex modern ransomware actually is.

In 2026, ransomware is not just malware.
It is a multi-stage cybercrime operation combining intrusion, persistence, data theft, and extortion.

Let’s break it down realistically.

Ransomware starts long before encryption

Most people think ransomware “just appears” and starts encrypting files.

In reality, encryption is usually the final stage.

Attackers first need access, which is typically gained through:

🔹 Phishing
fake login pages
malicious attachments
credential harvesting
🔹 Exploited vulnerabilities
unpatched VPNs
exposed RDP services
software zero-days
🔹 Stolen credentials
leaked passwords
credential stuffing attacks
reused passwords across services

👉 At this stage, attackers are already inside the system — ransomware is just the final payload.

Initial execution and system analysis

Once inside, the ransomware binary is executed.

Before doing anything destructive, it often:

checks if it is running in a virtual machine
detects security tools (Defender, EDR, sandbox)
escalates privileges to admin/system level
delays execution to avoid detection

👉 This is why many infections are not immediately visible.

Network and file system reconnaissance

Modern ransomware does not encrypt randomly.

It first maps the environment:

local drives (C:, D:)
network shares
backup locations
cloud-synced folders

It also identifies valuable file types:

documents (.docx, .pdf)
databases (.sql, .db)
archives (.zip, .bak)

👉 The goal is maximum impact with minimum effort.

The encryption model (hybrid cryptography)

Modern ransomware uses hybrid encryption, not simple file locking.

Step 1: Fast encryption per file

Each file is encrypted using:

AES (Advanced Encryption Standard)
ChaCha20 (in newer variants)

This allows fast processing of large data volumes.

Step 2: Key protection

The AES keys are then encrypted using:

RSA
ECC (Elliptic Curve Cryptography)

The attacker holds the private key.

👉 Without the private key, recovery is practically impossible.

File encryption in practice

The ransomware loops through files and:

opens file
reads content into memory
encrypts data
overwrites or replaces original file
renames file (often adding custom extension)

Example:

report.docx → report.docx.lockbit

It usually avoids system-critical files to keep the OS running.

Destruction of recovery options

To prevent easy recovery, ransomware often:

deletes shadow copies
disables system restore
removes backup snapshots
stops recovery tools
clears event logs

Example commands used in attacks:

vssadmin delete shadows
wbadmin delete catalog

👉 This ensures victims cannot restore data easily.

Double extortion: the modern standard

In 2026, encryption alone is not enough for attackers.

Most groups now use double extortion:

Step 1: Data theft

Before encryption:

files are copied
sensitive databases extracted
credentials stolen
Step 2: Encryption

System is locked locally.

Step 3: Blackmail

If ransom is not paid:

stolen data is published or sold

👉 Even backups do not fully protect against this model.

Ransom note and communication system

After encryption, victims typically see:

ransom note files in folders
changed desktop wallpaper
instructions for payment

Modern groups also use:

Tor-based negotiation portals
live chat systems
“customer support” style communication

👉 Ransomware gangs now operate like service platforms.

Why recovery is extremely difficult

The key reason:

👉 asymmetric cryptography

AES/ChaCha20 = fast encryption
RSA/ECC = locks decryption keys

Without the private key:

brute force is computationally impossible
decryption is not realistic

Even advanced recovery tools usually fail.

Real-world insight: ransomware is not just malware

Modern ransomware is best understood as:

a structured cybercrime business model combining intrusion, automation, encryption, and extortion

It is not random malware anymore — it is organized infrastructure.

Final thoughts

Ransomware in 2026 is no longer just about locking files.

It is about:

stealing data
disabling recovery
applying psychological pressure
monetizing access in multiple ways

And the key takeaway is simple:

👉 once encryption starts, the real failure already happened earlier — at the access stage.

How ransomware actually encrypts files (real-world explanation, not theory)

Marek „Netbe” Lampart — Sun, 05 Jul 2026 14:48:24 +0000

Ransomware is often described in a very simplified way: “it encrypts your files and demands payment.”
That explanation is correct, but completely useless if you want to understand what actually happens on a technical level.

In this article, I’ll break down how modern ransomware really works in practice — based on real attack patterns used by families like LockBit, BlackCat, and others.

1. Initial access – how ransomware gets into the system

Before encryption even starts, attackers need access. This usually happens in one of these ways:

🔹 Phishing

A user opens:

malicious email attachment (PDF, DOCX, ZIP)
fake login page
macro-enabled document

🔹 Exploiting vulnerabilities

Unpatched systems are often targeted:

exposed RDP
VPN vulnerabilities
Windows zero-days

🔹 Stolen credentials

Attackers log in directly using:

leaked passwords
credential stuffing
reused passwords

👉 Important: ransomware is rarely “random”. It’s usually a planned intrusion.

2. Payload execution – the ransomware is launched

Once inside, the attacker deploys the ransomware binary.

At this stage, it typically:

checks system environment (VM detection, sandbox evasion)
disables security tools (Defender, logs, recovery tools)
escalates privileges (admin rights)

Some variants even sleep for hours or days to avoid detection.

3. Reconnaissance – mapping the system

Before encryption, ransomware “explores”:

drives (C:, D:, network shares)
connected devices
file types (documents, databases, backups)

It builds a target list in memory.

👉 This is why network drives often get encrypted too.

4. Key generation – the most important part

Modern ransomware uses hybrid encryption:

Step 1: Fast symmetric encryption

Each file is encrypted with:

AES (most common)
ChaCha20 (in newer strains)

This is fast and used for bulk encryption.

Step 2: Public key encryption

The symmetric keys are then encrypted using:

RSA
ECC (Elliptic Curve Cryptography)

The attacker keeps the private key.

👉 This is why you cannot “reverse engineer” encryption easily.

5. File-by-file encryption process

Now the ransomware starts looping through files:

For each file:

open file
read content into memory
encrypt with AES/ChaCha20
overwrite original file or create new encrypted copy
rename file (often adding extension like .lockbit, .enc)

It usually targets:

documents (.docx, .pdf)
databases (.sql, .db)
backups
archives (.zip, .rar)

It often avoids system-critical files to keep Windows running.

6. Deleting recovery options

To make recovery harder, ransomware often:

deletes shadow copies (vssadmin delete shadows)
disables recovery tools
removes backups if accessible
clears logs

This is why system restore often stops working.

7. Ransom note delivery

After encryption:

text file is dropped in every folder
desktop wallpaper is changed
instructions are shown

Usually includes:

Tor payment site
Bitcoin/Monero address
countdown timer

8. Data exfiltration (modern ransomware trend)

Many modern attacks are double extortion:

Before encryption, attackers also:

copy sensitive files
steal databases
exfiltrate credentials

Even if you restore backups, data can still be leaked.

9. Why recovery without key is nearly impossible

Because of hybrid encryption:

AES/ChaCha20 = fast encryption per file
RSA/ECC = protects AES keys

Without private key:
👉 brute force is computationally impossible

10. Real-world insight (important)

Ransomware is not “magic encryption malware”.

It is closer to:

a structured automated data destruction system combined with extortion logic

Modern groups operate like companies:

affiliates
infrastructure teams
negotiation portals
customer support (!)

Final thoughts

Understanding ransomware at this level shows something important:

👉 prevention is far easier than recovery

Because once encryption starts, the system is already compromised at multiple layers.

Checker portów IP i DNS – jak sprawdzić bezpieczeństwo i konfigurację sieci online

Marek „Netbe” Lampart — Sun, 05 Jul 2026 14:33:49 +0000

W sieci działa ogromna liczba usług, które komunikują się ze sobą przez konkretne porty i rekordy DNS. W praktyce większość problemów z bezpieczeństwem infrastruktury nie wynika z zaawansowanych exploitów, tylko z prostych błędów konfiguracji — np. otwartych portów, nieświadomie wystawionych usług albo błędnych rekordów DNS.

Dlatego narzędzia typu port checker / IP checker / DNS lookup stały się jednym z podstawowych sposobów szybkiej diagnostyki sieci.

W tym artykule wyjaśniam, jak działają takie narzędzia i jak można je wykorzystać do analizy bezpieczeństwa własnej infrastruktury.

Checker portów, IP i DNS – jak sprawdzić bezpieczeństwo i konfigurację sieci online

netbe.pl