15

This question already has an answer here:

How does using SSL protect aginst dns spoof? since DNS is at a lower level and it is always work the same whether the user is visiting an HTTP or HTTPS site.

|improve this question

marked as duplicate by D.W., Xander, Scott Pack, M'vy, WhiteWinterWolf Jul 19 '15 at 8:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

21

Assume you managed to poison the DNS cache for securesite.com with an IP that you control. Now, when the client visits https://securesite.com, it will resolve to your IP address. As part of the SSL handshake process, your server will need to send a valid certificate for securesite.com which contains the public key.

At this point, you have 2 options.

1) Send the legitimate certificate. This will check out since the certificate is signed by a trusted CA. The client will then encrypt the master secret using the public key. It breaks down at this point, because without the private key, you cannot decrypt the master secret and thus you can't finish the connection setup.

2) Send a self signed certificate. However, since it is not signed by a trusted CA, a warning will show on the client's browser. If the client choose to proceed anyway, then you have successfully carried out the attack.

DNS spoofing will generally not work on HTTPS websites unless the client chooses to ignore the warning signs or if you manage to obtain the private key for the site.

|improve this answer
  • One thing about this: it's common in my country to people ignore those warnings because our government CA isn't installed by default in browsers. It's security hole here, I don't know about other countries. In the other hand: use HSTS to disable the possibility to ignore the warning, better if pre-loaded. – Gustavo Rodrigues Jul 18 '15 at 21:19
  • @GustavoRodrigues I just randomly went to US government sites and it looks like IRS.gov has a bad certificate. Not the same problem, but leads to the same bad user behavior. – IllusiveBrian Jul 19 '15 at 0:02
  • @Namfuak - that's because they outsource to Akamai and leave the old certs. Same for the FDA. – Deer Hunter Jul 19 '15 at 2:11
  • 1
    Just wanted to add to this something that wasn't immediately obvious to me: you (i.e., the attacker) also can't just get an SSL certificate from Let's Encrypt or wherever, because that would require being owner of the domain, see "Domain Validation" here. – Ben Hoyt May 6 '17 at 21:45
  • Regarding the option 1: The client will believe that I am the genuine server. So what if I just do one of the following actions: 1)Alter the content of the page so that the client post sensitive data to non-secure url ? 2) Redirect the client to a non-secure http protocol ? – TSR Feb 4 '18 at 10:32
2

Let's say you DNS spoof a site, and redirect users to a server you control. Thats possible, but probably of no use if users visit the https version of the site since you do not have the private ssl key of the site you are spoofing and your victim will not be able to establish a ssl connection with your fake site.

An alternate way to something similar would be to use sslstrip and dns2proxy, but thats another topic.

|improve this answer
  • It does not matter if you have a specific private key. If you can generate a new DV certificate then the website will be recognized as legitimate by any browser. HTTP Key Pining could be a protection, but it is not liked anymore by browsers. – Patrick Mevzek Mar 18 at 23:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.