0

Someone recently boasted about adware which can inject ads from most networks, and using DNS spoofing would make the providers think that the ads were on a website owned by me (i.e. www.myscamsite.com), while the ads are actually on a normal website (i.e. www.stackoverflow.com). This sounds dubious to me, because most websites these days use HTTPS to prevent DNS spoofing.

My questions:

  • Could this method work on HTTP sites?
  • Could this method work on HTTPS sites (somehow?)

I know the ISP's did it to routers years ago, but that was before HTTPS.

  • What do you mean by 'the ads were on a website owned by me while the ads are actually on a normal website' ? Is it just an ad on stackoverflow.com that says "visit us on myscamsite.com"? What capabilities does the attacker have? Is the computer where the ads are shown infected (ie. either knowingly or unwittingly had the adware installed locally)? – Ángel Mar 18 at 22:17
  • "use HTTPS to prevent DNS spoofing": this makes no sense. If you can change DNS records (by being able to get replies coming from a false nameserver, or by changing responses in flight), you can point www.example.com to any IP of your liking, and even get an X.509 DV certificate for it, which will make HTTPS work without any suspicion of problem anywhere. DNS and HTTPS work at different layers, offer different features, have different risks and countermeasures. – Patrick Mevzek Mar 18 at 22:35
  • @Ángel yes, the computer would have to be infected. I mean that any ad from any network would be shown on a website which I do not own; only it would seem like the ad is being hosted on a website I do own, so I would profit. Supposedly. – WilkyRL Mar 18 at 23:07
  • @PatrickMevzek posts such as this one seem to suggest that it is very difficult to spoof a site with https. Admittedly, I do not know much about the subject. How do you change DNS records? is that possible? – WilkyRL Mar 18 at 23:11
  • @WilkyRL Post should be updated. Nowadays it is easy to get DV certificates, automatically and in a very short time. If you control final IP of the website you can get a completely valid recognized by all browsers X.509 certificate for it. DNS records can be changed: if you attack the registrar sponsoring the domain and manage to change the nameservers for the domain, or in flight if not using DNSSEC, answers can be spoofed. There are a ton of recent examples of attacks in both cases. Here is one: thenextweb.com/hardfork/2019/03/18/… – Patrick Mevzek Mar 18 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.