DNS Cache Poisoning & Spoofing: How It Works (2024)

FAQs

How does a DNS cache poisoning attack work? ›

Domain Name System (DNS) poisoning happens when fake information is entered into the cache of a domain name server, resulting in DNS queries producing an incorrect reply, sending users to the wrong website. DNS poisoning also goes by the terms “DNS spoofing” and “DNS cache poisoning.”

Domain Name Server (DNS) spoofing, or DNS cache poisoning, is an attack involving manipulating DNS records to redirect users toward a fraudulent, malicious website that may resemble the user's intended destination.

DNS cache poisoning is the act of entering false information into a DNS cache, so that DNS queries return an incorrect response and users are directed to the wrong websites. DNS cache poisoning is also known as 'DNS spoofing.

First, the attacker sends a target resolver a DNS query for a non-existent domain, like “fake.varonis.com.” The resolver then forwards the query to the authoritative name server to get the IP address for the false sub-domain.

How does DNS cache poisoning work? By tricking a DNS server into accepting a fake DNS record that will point you to a compromised DNS server. It then feeds you fake DNS addresses when you try to access legitimate websites.

Fake job offers, fake banking-related messages, fake lottery messages, money refund scams, and password reset messages are some examples of Text Message Spoofing. Spoofed messages are difficult to identify until the person is aware of where to look for them.

ARP (Address Resolution Protocol) spoofing is when an attacker sends a fake message onto a local area network with the goal of associating the attacker's MAC address with the IP address of another host. This causes any traffic meant for that IP address to be sent to the attacker instead.

Definition: DNS Spoofing is a type of computer attack wherein a user is forced to navigate to a fake website disguised to look like a real one, with the intention of diverting traffic or stealing credentials of the users.

A famous example of this type of attack happened in 2018, when hackers compromised Amazon's Route 53 DNS server and public Google DNS servers. After gaining access, they rerouted roughly 1,300 IP addresses to malicious phishing websites designed to steal user information.

During a DNS poisoning attack, a hacker substitutes the address for a valid website for an imposter. Once completed, that hacker can steal valuable information, like passwords and account numbers.

What are the signs of DNS spoofing? ›

DNS spoofing is the resulting threat which mimics legitimate server destinations to redirect a domain's traffic. Unsuspecting victims end up on malicious websites, which is the goal that results from various methods of DNS spoofing attacks.

Whereas some DNS spoofing attacks, like DNS cache poisoning (where your system logs the fraudulent IP address in your local memory cache), are focused on modifying the DNS records, DNS hijacking involves changing the DNS settings themselves, often by installing malware on the victim's computers.