3 ms·
I've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell t
by theonemind 6y ago
I've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell them to do it. The first big ISP would get it working pretty quickly no matter what Google did, then other big companies would see it and tell their sysadmins to figure it out, the other company is already doing it.
I bet there's a decent amount of cash in DNS hijacking for big players, so you should probably think of it like the hypothetical cryptography attacker. You should assume they will know everything about your method but still can't beat it. If you can tell them what you're doing and they can beat it, they will. They wouldn't have done it in the first place without motivation.
- SAI_Peregrinus 6y agoSend one request to such a random domain over DoH or DoT to some DNS server you control for the purpose (Google can easily set such a thing up). Ensure the response is NXDOMAIN. If it's not, generate a new random domain and retry. Send a second request of the same domain via the system DNS. If it's not NXDOMAIN, it's hijacking unknown DNS requests. One request that might hit the root instead of 3.