When would a DNS attack actually happen?

Is it already possible when i connect my pc to the router which is connected to my isp's modem and has received their DNS servers, or later when i am trying to reach a website? If the second possibility is true i guess using tor browser or whonix would be an adequate protection if one only wishes to browse the web safely. I heard about DNS leaks in some instant messaging programs.

  • 1
    Your question does not make sense. – ecnepsnai Jul 13 '15 at 23:32
  • i heard about DNS attacks that are possible when there is an unencrypted DNS connection. I want to knoe if the connection to the ISP and its DNS servers is enough to start sauch an attack or if the user has to start an unencrypted DNS request to a website to make ayn attack possible. I hope this clarifies it, my knowlege in this field is very low so i don't know how else i can express it. – Junior J. Garland Jul 14 '15 at 0:03

A DNS attack happens when an attacker can influence how your computer will resolve host/domain names.

That can happen if an attacker is able to:

  1. Change the DNS server IP address in the network settings on your computer
  2. Change the DNS server IP address in the network settings on your router
  3. Change the hosts file on your computer
  4. Intercept and change DNS responses that are going to your computer
  5. Poison the DNS cache of the DNS server you are using, or the cache of your router or your PC
  6. There are also other ways...

If that happens, the attacker can easily redirect you to sites you did not intend to visit. For example if you type in www.google.com in your browser, your browser will try to first resolve that host/domain name to an IP address. And if the attacker is controlling the way your PC does that, he can send you any IP he wants that you will then visit instead of the IP of www.google.com.

When using the ToR browser, your PC is not resolving the host/domain name to an IP address, but the ToR exit node does that. If the ToR exit node is attacked, you could again be redirected to wrong destinations.

| improve this answer | |

When would a DNS attack actually happen? [...] [W]hen [...] my pc [first receives DNS servers from] the router which is connected to my isp's modem?

That's an interesting possibility, to somehow inject an attacker's DNS servers in DHCP replies. This is not how it's usually done however, because an attacker can't get between the user's computer and the ISP any easier than just attacking the ISP.

or later when i am trying to reach a website?

This is usually when it happens. When your computer asks an ISP's DNS server to resolve a host, the ISP's DNS server may have to check with other DNS servers on the web if it doesn't have fresh answers in it's cache. Attackers usually try to either exploit weaknesses in the the site's DNS servers or DNS hosting, allowing records to be modified (this is supposedly easier to pull off than a full compromise). Or other DNS servers in the chain of DNS request delegation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.