3 ms·
I think this type of attack being described was (is) actually done by hijacking requests that should have returned DNS NXDOMAIN. You tried to visit a URL that
by yebyen 10y ago
I think this type of attack being described was (is) actually done by hijacking requests that should have returned DNS NXDOMAIN. You tried to visit a URL that did not exist, but your DNS server failed to make that clear in the standard way to your browser, and now your traffic is sent somewhere else, instead of sending you to the familiar (or ugly, they might argue) NXDOMAIN browser error page.
So there aren't really any packets being modified, since you already get your DNS from your ISP. They're just returning bad information to requests that your browser naturally had directed at them.
- koolba 10y agoThe NXDOMAIN hijack isn't as bad as this. It involves replacing the response from the resource you requested with the ISPs preferred response. It can happen either through DNS hijacking (nslookup for google.com goes to isp-fake-google.com) or they can just sniff all the traffic and MITM HTTP traffic for "GET /q=?" with a "Host: google.com". In either case they send you to whatever they'd like rather than the original request (and of course sell the data that User X searched for Y).
- resfirestar 10y agoNXDOMAIN hijacking is closely related, but Paxfire had another service (at least in 2011, when fewer searches were done over SSL) that was sending all traffic directed to the major search engines through its proxy servers. https://www.eff.org/deeplinks/2011/07/widespread-search-hijacking-in-the-us https://www.eff.org/deeplinks/2011/07/widespread-search-hija...