2

Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my passwords and plain text data on HTTP websites? If not, are they capable of doing anything else malicious?

8

Not directly, but they can collude with other agents to see passwords sent in clear-text.

All that a DNS server is used for is mapping a domain name to an IP address. So DNS servers will never see data you communicated between you and a website. They just aren't involved in that part of the communication.

That said, a DNS server can incorrectly return an IP for a website that is running a phishing or similar scam. You might then enter your credentials into that fake site. This is easy to do as your URL bar will state that you're visiting your intended destination site even though you are visiting a scammer's site.

So, a rogue DNS server cannot steal your passwords, but a rogue DNS server in cahoots with a phishing site can certainly steal your credentials.

If you are using HTTPS and don't blindly click through security logins, HTTPS will ensure that you are talking to the real site and not a phisher.

  • 1
    This is more than true. Phishing sites these days are crazy.. I've seen some that will actually log you into the site, or keep you on their site and pass you the HTML, or stick some JS in your browser, performing MITB attacks. It's a dangerous world out there. – xorist Mar 11 '16 at 23:38
  • I think a clarification is warranted here. From the standpoint of DNS spoofing or poisoning (the context of this question), HTTPS will ensure that you are talking to the real site (assuming it normally uses a valid cert). It doesn’t help with active types of phishing where a link is actually supplied. – user18519 Sep 19 '18 at 10:58
  • I'm not sure I understand what change would you are recommending, @user18519. Do you have a suggestion? – Neil Smithline Sep 20 '18 at 12:48
  • @NeilSmithline it’s what you intended in the first place, I just don’t think it’s explicit enough and leaves room for misunderstanding from the uninitiated. Focusing on the last paragraph specifically - HTTPS will ensure that you are talking to the real site provided that the hostname is correct. If you arrive there via a link, all bets are off, basically. You could land on an IDN homophone domain with a valid cert, not get any warnings, and still get phished. – user18519 Sep 20 '18 at 12:56
  • 1
    @Shayan - the only way that a man-in-the-middle (MiTM) server can eavesdrop is if they have a genuine certificate for the target site. With that cert and a compromised DNS server, they basically own the domain and can do whatever they want. Getting real fake certs is at least somewhat difficult. One strategy to prevent problems is to use a trusted DNS server and not that of your ISP. Google (8.8.8.8) and CloudFlare (1.1.1.1) are some of the more frequently used DNS servers (not an endorsement, simply an observation). – Neil Smithline Jan 2 at 17:21
2

No, the DNS server couldn't see that stuff. Though, there might be other mean things it could do to you.

A DNS (Domain Name Server) is just used to tell your computer what the IP Address of the specified URL is. What you might need to lookout for are the hops. if you do tracert google.com in your command prompt on a windows system, you will see all of the hops it has to take in order to get to the actual google servers. There might could be little nasties lurking in between there.

Some baddies might could also perform an attack called DNS hijacking. Which is where an attacker would specify a website like google.com to be an IP address that it really isn't in their evil DNS.

0

No, they are unlikely to see your passwords. The DNS sever is queried in the process of converting a domain name (i.e. www.google.com) to an IP address (i.e. a string of numbers), this process is called address translation. The DNS server is not involved in any other part of your Internet access.

Yes, DNS servers can be hacked. In particular, DNS poisoning is a problem where the IP address table of a DNS sever cache becomes filled with wrong IP addresses. For example, your update server's domain name for your operating system might be redirected to the wrong IP address and you might receive tainted updates.

  • 1
    But, as was explained in other answers, the malicious DNS entry can send you to a malicious site designed to capture your credentials for the legitimate site. – schroeder Mar 12 '16 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.