DNS Spoofing

What is domain name system (DNS) spoofing? 

 DNS Spoofing involves corrupting an Internet server's Domain Name System table by replacing a valid Internet address with that of another, rogue address. When a web user looks for the affected page, the request is redirected to a different address where a worm, spyware, web browser hijacking program, or other malware can be downloaded to the user's computer from the rogue location. 

DNS Spoofing Attack 

A DNS Spoofing attack is possible because of HTTP Response Splitting and flaws in the web application. DNS Spoofing can be transmitted within spam email messages, images, and banner ads, increasing the rate at which rogue programs are spread. 

With man-in-the-middle (MITM) attacks, attackers intercept communication between a user and a DNS server, and forge destination IP addresses to point to malicious domains. 

If a response is cached in a shared web cache commonly found in proxy servers, all users of that cache will continue to receive the malicious content until the cache entry is purged, this is known as DNS cache poisoning. The same is true if the response is cached in an individual user’s browser. With cache poisoning the risk goes beyond the DNS server that was originally infected and persists over an extended period of time. 

How to prevent DNS Spoofing?

 DNS servers require strong security configurations to guard from being compromised and hijacked by hackers. Strategies for mitigation: 

• Use proper SSL/TLS encryption for DNS requests and responses to protect against MITM attacks. 
• Apply source port randomization on the DNS server to decrease the probability of being successfully predicted and targeted by attackers. 
• Ensure both the server’s operating system and DNS software are kept up-to-date, as servers with known vulnerabilities are often actively targeted by hackers. 
• Actively monitor DNS data for any unusual patterns that could indicate the presence of an attacker, such as a new external host 
• Use strong router passwords and enforce a secure password policy across the entire network to keep every device within the network sufficiently protected. 

Additional Resources

• Top 10 Application Vulnerabilities of 2019
• Stopping Magecart Attacks