0

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist.

If I do following on my Windows machine:

  • ipconfig /flushdns - flush DNS cache
  • ping apple - invoke DNS query
  • ipconfig /display - see DNS cache

the ping command doesn't fail and I can see DNS entry in the output.

I tried visiting http://apple on both Windows machine and Android machine (which I checked are both using the same DNS config), my Android machine can't find the domain.

My question: What could possibly be acting maliciously between Windows' DNS client and the DNS server, or how could I go about finding where the malware is installed?


Note: my Windows machine is connected to router via Ethernet, while Android device uses Wi-Fi.

  • Do you mean the domain is literally "apple", with no TLD at all? – forest Dec 30 '18 at 1:43
  • @forest Yes, its just http://anything. – accidentallygivenfuck Dec 30 '18 at 16:18
  • 1
    Where is the DNS server, and who controls it? Who controls the path between you and this DNS server? The DNS server can be configured to lie about responses and just fake some, or someone on the path may be altering your DNS requests or replies. Try to use first any open public resolver and see if issue persists: 1.1.1.1, or 8.8.8.8 or 9.9.9.9 or 80.80.80.80. You can also try DoH and/or DoT some of the previous nameservers do provide that. – Patrick Mevzek Jan 1 at 6:41
0

It is hard for me to fully understand your question and the problem you explained. If you mean you can access in your windows machine:

http://apple.com

and you are presented a webpage, then something is wrong.

Because you say the same behavior does not happen in your Android and that it has the same DNS configurations of your windows machine, the router is perhaps not the source of the problem, meaning it is not compromised

I also noticed that you flush your DNS cache in your Windows machine, hence a DNS poisoning directly into your machine may also be excluded, unless it is persistent. There could be a malicious process running in the background and that has the rights to redirect your DNS traffic and give you some fake responses, either from hard coded webpages pages within the malware code or from some files hidden in your file system.

After pinging apple.com you should see what the IP address is. If it is your own, or one in your homenetwork, then clearly it is a man in the middle attack. If it is a public IP address, run a WHOIS request on some site that offers that service.

Finally what you can also do is install wireshark and run it while you make the ping request, this will allow you to see where the packets go exactly.

This is not a real answer, but without more details it is hard to provide you with one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.