2

Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my passwords and plain text data on HTTP websites? If not, are they capable of doing anything else malicious?

8

Not directly, but they can collude with other agents to see passwords sent in clear-text.

All that a DNS server is used for is mapping a domain name to an IP address. So DNS servers will never see data you communicated between you and a website. They just aren't involved in that part of the communication.

That said, a DNS server can incorrectly return an IP for a website that is running a phishing or similar scam. You might then enter your credentials into that fake site. This is easy to do as your URL bar will state that you're visiting your intended destination site even though you are visiting a scammer's site.

So, a rogue DNS server cannot steal your passwords, but a rogue DNS server in cahoots with a phishing site can certainly steal your credentials.

If you are using HTTPS and don't blindly click through security logins, HTTPS will ensure that you are talking to the real site and not a phisher.

6
  • 1
    This is more than true. Phishing sites these days are crazy.. I've seen some that will actually log you into the site, or keep you on their site and pass you the HTML, or stick some JS in your browser, performing MITB attacks. It's a dangerous world out there.
    – xorist
    Mar 11 '16 at 23:38
  • I think a clarification is warranted here. From the standpoint of DNS spoofing or poisoning (the context of this question), HTTPS will ensure that you are talking to the real site (assuming it normally uses a valid cert). It doesn’t help with active types of phishing where a link is actually supplied.
    – user18519
    Sep 19 '18 at 10:58
  • I'm not sure I understand what change would you are recommending, @user18519. Do you have a suggestion? Sep 20 '18 at 12:48
  • @NeilSmithline it’s what you intended in the first place, I just don’t think it’s explicit enough and leaves room for misunderstanding from the uninitiated. Focusing on the last paragraph specifically - HTTPS will ensure that you are talking to the real site provided that the hostname is correct. If you arrive there via a link, all bets are off, basically. You could land on an IDN homophone domain with a valid cert, not get any warnings, and still get phished.
    – user18519
    Sep 20 '18 at 12:56
  • 1
    @Shayan - the only way that a man-in-the-middle (MiTM) server can eavesdrop is if they have a genuine certificate for the target site. With that cert and a compromised DNS server, they basically own the domain and can do whatever they want. Getting real fake certs is at least somewhat difficult. One strategy to prevent problems is to use a trusted DNS server and not that of your ISP. Google (8.8.8.8) and CloudFlare (1.1.1.1) are some of the more frequently used DNS servers (not an endorsement, simply an observation). Jan 2 '19 at 17:21
0

No, they are unlikely to see your passwords. The DNS sever is queried in the process of converting a domain name (i.e. www.google.com) to an IP address (i.e. a string of numbers), this process is called address translation. The DNS server is not involved in any other part of your Internet access.

Yes, DNS servers can be hacked. In particular, DNS poisoning is a problem where the IP address table of a DNS sever cache becomes filled with wrong IP addresses. For example, your update server's domain name for your operating system might be redirected to the wrong IP address and you might receive tainted updates.

1
  • 1
    But, as was explained in other answers, the malicious DNS entry can send you to a malicious site designed to capture your credentials for the legitimate site.
    – schroeder
    Mar 12 '16 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.