Through a DNS poisoning attack, a hacker replaces the address of a legitimate website with a fake one. Once achieved, that hacker can steal delicate knowledge, like passwords and numbers of an account. The hacker can also deny loading your site, which is spoofed.
What does DNS poisoning mean?
DNS poisoning, also called DNS spoofing, is a technique, which hackers use. It manipulates identified weak spots inside the domain name system (DNS).
When it is made, a hacker can direct traffic from one genuine site to a fake version of it. And because of the way DNS works, the infection can spread further.
How is DNS spoofing performed?
When you want to visit a site, your server pulls up a response from the hacker. Thus, the forged data is stored. And this makes DNS cache poisoning accomplished.
A hacker can achieve this by:
- Binding the server. Hackers are capable of sending a lot of queries to a caching server. Afterward, they send thousands of fake responses. And at some point, they take control of the root domain and the whole site.
- Server simulation. The hacker responds a lot quicker with the wrong answer when your DNS server submits a query for a translation. And this is happening long before the correct server can do so.
- Exploiting open ports. Hackers can send to DNS resolver ports thousands of queries. They identify which port is open in time. The focus for future attacks will be only on this port.
DNS poisoning attacks are happening because the system is not secure enough. Your devices are holding conversations with servers with the help of the User Datagram Protocol (UDP). The connection is provided fast and efficiently. The problem is that no security measures are built-in. Your device is not able to verify the server’s identity. And also, it doesn’t validate the information that comes back.
It is easy to perform fabrication in such an environment. Someone can own the server you are corresponding with. And the fact that proving your identity is not a must. That could lead you to receive forged data and probably never know about it.
DNS poisoning and DNSSEC
DNS does not contain encryption. That makes intercepting the traffic with spoofing an easy job. Furthermore, DNS servers do not verify the IP addresses to which they are redirecting the traffic.
Here comes DNSSEC, which is a protocol created to add more ways and methods of verification and make your DNS more secure. This protocol is able to generate an individual cryptographic signature and store it together with your other DNS records, like A record, CNAME, CAA etc. Then your DNS resolver uses this specific signature to validate a DNS response. So this way, it is guaranteeing that the record wasn’t falsified.
DNSSEC is a great service that can help you protect yourself from DNS poisoning.
Conclusion.
DNS poisoning is a serious problem, and it could be terrifying. Protecting and configuring a DNS server accurately is going to help you to avoid such things from happening.