DNS Poisoning
DNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web server. On paper the name is the same. In reality the road leads somewhere else.
Term
description · examples · notesDNS poisoning is an attack in which a user or a resolver is given a false answer for a domain. The result is that the user types a familiar address into the browser and DNS takes them to the wrong web server. On paper the name is the same. In reality the road leads somewhere else.
Description
Unlike DNS amplification, which targets availability, DNS poisoning targets the integrity of the answer. The attacker wants to change the mapping between a name and an IP address. That way they can steer users to a fake page, intercept communication, or distribute malware from somewhere that resembles the legitimate source.
DNS is one of the layers users rarely think about and rely on constantly. When that layer lies, the user can be in the wrong place before they even see the page. That is why DNSSEC, answer validation, HSTS and due attention to certificates make sense.
Examples
- A resolver returns a false IP address for a well-known domain, so users end up on a site the attacker controls.
- A user tries to open their bank, but DNS poisoning takes them to a page that steals credentials.
- A local network uses a compromised DNS server that redirects popular domains to false addresses.
Notes
- DNS amplification buries the victim in traffic. DNS poisoning changes the answer and leads the user to the wrong place. A similar layer, an entirely different consequence.
- HTTPS is no magic cure, but a certificate warning in an attack like this is not something to click past.
Techniques
carried out with 1Techniques used to carry it out. Select one to open its page.
Defenses
countered by 4How it is defended against. Select one to open its page.