Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been thinking of using for accessing "geo-IP banned websites" like netflix.

However, I have my concerns about safety of using some third party DNS server for everything. So, my question is. Let's suppose I use something like or some other third party DNS server. What "evil" they can and can't do?

Let's also add these assumptions.

  • I access mails, facebooks and most importantly bank accounts only through https, but I don't check the certificates by hand, but let my browser do it for me
  • I generally disallow any third party plugins in browser as much as I can (flash, java, Acrobat)
  • I am smart enough not to fall for completely obvious phishing
  • I install actualization, but I don't use antivirus (since I use OS X and Ubuntu)

With all this said - if I use some third party DNS server and it becomes malicious, what can they do?

share|improve this question

migrated from Jun 20 '13 at 18:45

This question came from our site for computer enthusiasts and power users.

Malicious DNS alteration usually drives people to phishing sites instead of the legitimate site they want, but it can also be used to prevent machines from retrieving updates for their OS/Security software, or route your connections through a proxy where an adversary can intercept communications.

share|improve this answer
Hm. But if I access those sites by https, it shouldn't matter - it can't show me their version of a website and the communication will be encrypted anyway, no? – Karel Bílek Jun 20 '13 at 16:23
true, which is why phishing is less popular these days, but as the post you highlighted in your answer says, a sufficiently advanced adversary is capable of performing MITM attacks and interception on SSL streams. ISPs in particular have a disturbing capacity to insert themselves into an https stream.… – Frank Thomas Jun 20 '13 at 18:08
@FrankThomas That article makes some grand assumptions which are false. It is actually very difficult to MITM attack an SSL connection. The NSA could potentially do it, but that would require them to gag-order one of the root CA to sign a wildcard signing key. Otherwise, if you can trust the root CAs in your browser (i.e., not your work computer), then you can trust the SSL connection. Certificate pinning will even stop the NSA from doing a MITM attack. – Darth Android Jun 20 '13 at 18:40
@DarthAndroid - Certificate pinning will not necessarily stop the NSA; if the NSA wanted to MitM https traffic to for anti-terror work, they could potentially force by court order that (or the CA example uses) to give the original private certificate used by to the NSA. (I agree that certificate pinning raises the bar, as you can't change the certificate if an attacker manages to successfully attack one certificate authority). – dr jimbob Jun 20 '13 at 19:14
....if I am attacked by NSA that can forge certificates, it doesn't matter if I have or haven't the right DNS in the first place since the NSA can just use the actual server – Karel Bílek Jun 20 '13 at 21:37

Say you go to but using an attacker-controlled DNS entry points to an attacker controlled IP address. What can they do? On the face of it, not too much unless they control or can fool a certificate authority that your browser trusts and can get a signed private certificate for (or simply steal the private certificate for They should not be able to re-direct you to without your browser popping up a huge warning that the certificate is not for and some social engineering to explain it away.

Granted if you just type in / in your browser, your browser may first go to and normally redirect you to With malicious DNS entry they could intercept the request to and not redirect you to the HTTPS version. Then they can complete eavesdrop, intercept your passwords, and perform a Man-in-the-Middle attack.

share|improve this answer

If you are using the same computer for your banking, checking emails, I would strongly suggest not to change your DNS settings. In case you forget to change it back to your ISP's DNS server and try to access your email or banking site, you maybe redirected to one of their sites to enter the information.

share|improve this answer

I found out this answer sufficient

Also, tunlr has this amazing page about privacy and safety

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.