DNS poisoning

ramnarayan · Post by **ramnarayan** » 10 Oct 2005, 04:39

Hi,

New here. I've heard of scammers/ phishers using DNS poisoning techniques to make it seem as if "victims" are going to the legitimate site whereas they are being redirected to the scam one.

Can anyone explain what this (DNS poisoning) is? And how it is done?

>> Please move this to the right forum if this is not the place for this question. Apologies if this is the case.

Thanks,
Ramnarayan.

masterdriverz · Post by **masterdriverz** » 10 Oct 2005, 13:05

Basically, DNS is like an address book. It resolves a host name e.g. www.google.com to an IP address e.g. 66.102.9.99 (google's ip). DNS Poisoning happens when you make a user believe they are accessing a legitimate site when in fact the address is being resolved to an different IP, usually one of a server which contains a phishing website, ie, one that records your username or bank details, and then redirects you to the legitimate site, meaning you're not even aware your identity has been stolen.

Hope this makes sense

MD

ramnarayan · Post by **ramnarayan** » 11 Oct 2005, 09:22

Hi MD,

Thanks for answering my question. Now, since this can be done, can someone explain how its done or even if someone can detect if this has been done to one's DNS record?

MD, once again, thanks for the answer!

Regards,
Ramnarayan.

masterdriverz · Post by **masterdriverz** » 11 Oct 2005, 10:15

Its done using a man-in-middle attack, where the attacker intercepts traffic going both ways. And while its not technically possible to detect, as traffic both ways is intercepted and modified, using encrytion to communicate with another system, which will resolve the hostname to a legitimate IP. However, DNS poisoning can be done on an even lower level, called ARP poisoning (correct me if I'm wrong), where although the target believes a packet has been sent to the correct IP, it has in fact been intercepted and modified, and may not even reach its destination.

Hope this helps

MD

Post by **bad_brain** » 12 Oct 2005, 14:38

ARP poisoning manipulates the content of the target´s ARP (adress resolution protocol) cache. In the ARP cache the lookup tables of known hosts (the host must have been contacted before) are stored. an attacker which uses ARP poisoning is changing the MAC-adress (also known as hardware adress) of a known host to an adress which he controls, so he can intercept the network traffic and try to find sensitive informations.
so ARP poisoning is more the part of an active attack against a host or network, for scammers it´s not very useful because the ARP cache is emptied every 30 minutes per default (at least on Unix systems)...

ramnarayan · Post by **ramnarayan** » 15 Oct 2005, 11:51

MD and Bad Brain - Thanks for the info!

Still trying to digest some of it, but I hope I will understand the entire concept soon and try to simulate it if I can (in my brain atleast).

Learning everyday i spend here!

Thanks guys.

Post by **bad_brain** » 15 Oct 2005, 12:18

np...read a little about the TCP/IP protocol family, you´ll find some nice stuff in the textfiles section. it´s very useful to know how networking basically works, and in my opinion it´s even unevitable...

Merchant · Post by **Merchant** » 30 Oct 2005, 19:14

hey, i kinda jumped in, i wanted to know, what is the technical aspect of DNS? is it a program, ect...? can anyone tell me??

Merchant

Ameradi · Post by **Ameradi** » 30 Oct 2005, 20:03

Hey Merchant... check this out :

http://en.wikipedia.org/wiki/DNS

Merchant · Post by **Merchant** » 30 Oct 2005, 21:07

muchas gracias

Merch