4 ms·
Can someone explain how the DNS poisoning actually happens in practice? Is it via an insecure Wi-fi network? Because I assume that most people's upstream DNS is
by lordgrenville 4y ago
Can someone explain how the DNS poisoning actually happens in practice? Is it via an insecure Wi-fi network? Because I assume that most people's upstream DNS is provided by their ISP, which is probably basically competent. I use an Unbound server at home, but I really struggle to imagine a rogue actor compromising my ISP without anyone noticing.
- nym375 4y agoNot directly answering re: DNS, but even if you get correct DNS results, at the IP layer there is always a risk of BGP hijacking (https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents https://en.wikipedia.org/wiki/BGP_hijacking#Public_incidents).
- toast0 4y agoThe easiest way is if the attacker is in the path between a DNS client (which could be your ISPs recursive server) and an authoritative server. But anytime there's caching, you have a risk of the wrong thing getting cached. There's the Kaminsky attack, if your ISP's DNS server doesn't properly randomize query ids and source ports (and query case, for a few extra bits) But you can also get unintentionally wrong information cached, if something flips a bit on the way, as DNS doesn't have end to end integrity.
- flumpcakes 4y agoDNS is public traffic, on a well known port. I just have to have your network traffic go through a device I own and I can set your DNS results to anything I want, even if you specifically specify a DNS server on your end.