2

I was reading an e-book about different types of attacks and found this:

A skilled hacker can intercept DNS replies from servers and replace the IP addresses for the requested names with addresses of machines that the hacker controls, thus providing an easy method for ongoing session attacks.

Does this mean that as soon as the attacker intercepts the packets, software replaces the addresses or does the attacker have to do it manually. If the latter is true, then can the victim tell that they are being hijacked from the delay?

Improve this question
1
  • There is no reason why an attacker wouldn't be able to automate it. The delay while processing the intercepted packets will likely be too low to notice it given the usual latency fluctuations on a network. – Arminius Aug 7 '17 at 18:53
2

This would be ideally done automatically.

I suggest you take a look at DNS Spoofing for reference then you can try it out (on your own privately controlled network) using something like mitmproxy or dnsspoof both of which are available on Kali Linux to intercept DNS requests and redirect them to your own DNS server, or alter the response as suggested in your eBook.

The problem with DNS is that it isn't encrypted or signed, so you don't know if the response is legitimate.

A mitigation against this attack is to use something like DNSSEC which (in brief) is an extension to the original DNS protocol and essentially adds authentication though signing responses so you know the response is from the server you asked.

Improve this answer
2
  • Are DNS requests the only way to hijack or are they just the easiest to intercept? Also, how do cookies/tokens fit into this? – romulox Aug 8 '17 at 22:13
  • Think about OSI layer model. You have a number of points at which you can hijack depending on your access to the network. From MAC using ARP spoofing up to cookies in the application layer. Cookies and tokens generally relate to an individuals access to a web application, if you can sniff or guess the cookie you can masquerade as a user. Take a look at free information security training such as Cybrary cybrary.it/course/ethical-hacking/# – Stu Aug 12 '17 at 14:04
1

Does this mean that as soon as the attacker intercepts the packets, software replaces the addresses or does the attacker have to do it manually

I think it's most likely that some software would replace the addresses once the DNS reply has been captured. However, the software might allow the user to do things manually which, as you suggested, would slow down the attack process.

As to the victim being able to tell if they're being hijacked, if the speed for the DNS reply to be altered and sent on is particularly slow, the victim may notice that loading webpages is slower than usual. Another thing to note is that the attack may also be noticed if the software being used to attack the victim just isn't very fast.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.