DNS Attacks - CompTIA Security+ SY0-701 - 2.4

Understanding DNS Poisoning Attacks

Overview of DNS and Its Vulnerabilities

• Domain Name Services (DNS) convert fully qualified domain names to IP addresses, essential for web navigation.

• Attackers can exploit DNS poisoning attacks, which may involve modifying the DNS server or client host files.

• Client-side attacks require access to the local machine and elevated rights to alter the host file.

Mechanisms of DNS Poisoning

• Attackers can intercept DNS queries in real-time, redirecting users to malicious sites by responding with altered information.

• An example scenario illustrates an attacker on a network altering responses from a legitimate DNS server.

Gaining Access to Modify DNS Configurations

• Attackers may gain access through vulnerabilities or administrative credentials, allowing them to change IP address mappings in the DNS configuration.

• If successful, subsequent requests will direct users to the attacker's IP instead of the legitimate site.

Domain Registration Exploits

• Accessing domain registration accounts allows attackers to control traffic flow and associated IP addresses for domains.

• Methods like brute force or social engineering can be used to compromise these accounts.

Case Study: Brazilian Bank Attack

• On October 22, 2016, attackers changed settings for 36 domains related to a Brazilian bank, impacting millions of customers.

• The incident highlights risks faced by organizations relying on secure DNS configurations.

Additional Redirection Techniques: URL Hijacking

Understanding Typosquatting and Brandjacking

What is Typosquatting?

• Typosquatting involves attackers registering misspelled domain names to exploit users' typing errors, potentially selling these domains back to the legitimate owners.

• Attackers can create fake websites that closely resemble legitimate sites, tricking users into entering sensitive information like usernames and passwords.

• This practice is also known as brandjacking, as it takes advantage of common misspellings made by users trying to access a legitimate site.

Examples of Domain Name Exploitation

• An example includes a legitimate URL like professormesser.com, which could be spoofed with slight variations in spelling (e.g., professormesser.com).

• Users may accidentally omit letters when typing the domain name, leading them to an attacker's registered domain instead of the intended site.