48
votes
How could a public DNS server return bad results?
How are they (ISP) achieving this, Are they really stealing and MITM ing the traffic of 8.8.8.8?
They probably simply redirect all packets with destination port 53 (i.e. DNS) to their own servers and ...
- 208k
31
votes
Does DNS allow third parties to register subdomains?
Short answer: No, third parties can't register a subdomain without authorization from the owner of the domain.
DNS is a hierarchical system, ordered from right to left in the hostname. Whoever has a ...
- 2,701
29
votes
Accepted
Does DNS allow third parties to register subdomains?
Welcome to Security!
The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...
- 5,418
21
votes
How could a public DNS server return bad results?
unfortunately they are not doing so!
They are doing so, and your typescript shows it happening, with nslookup querying that IP address and getting answers from it.
Your confusion stems in part from ...
- 701
19
votes
Does DNS allow third parties to register subdomains?
The DNS registrars only care about the registration of the primary domain, i.e. example.com. They don't care about any sub-domains like www.example.com or www.math.example.com and similar. These are ...
- 208k
19
votes
What is the most secure way to store cross subdomain cookies
From RFC 6265:
5.1.3. Domain Matching
A string domain-matches a given domain string if at least one of the
following conditions hold:
o The domain string and the string are identical. (...
- 6,130
13
votes
How could a public DNS server return bad results?
In short, your are being MITMed. The censor you're facing is doing something to your DNS requests directed at 8.8.8.8 so that you get non-genuine responses. There are many ways to achieve this, and ...
10
votes
Understanding TLS Protections Against DNS Spoofing and Fake Websites
The diagram assumes the initial connection is made using plain text HTTP allowing the attacker to redirect the victim to google.example.com instead of google.com. The TLS does not provide protection ...
- 19.4k
9
votes
Accepted
Strange Problem - DNS Cache Poisoning?
I agree with Steffen, this sounds like malvertising as the most likely cause, with a less likely option being compromise of the visited site with embedded redirects.
Running ad-blockers and script-...
- 154
8
votes
Understanding TLS Protections Against DNS Spoofing and Fake Websites
In the depicted scenario, assume that the user's initial request is to https://www.google.com (note the s at the end of https). The user's web browser looks up the A record for www.google.com, but ...
- 24k
6
votes
What problem does DNSSEC solve?
1. What is the goal of DNSSEC?
DNSSEC signs DNS records. It does not encrypt, it just confirms authenticity.
The root signs keys from TLDs (such as .org or .de), TLDs sign keys from registrars, and ...
- 33.1k
5
votes
What problem does DNSSEC solve?
It solves integrity guarantee. It will no longer be possible to MITM a signed zone. Right now anyone could falsify DNS records, with DNSSEC they cannot. The client already knows the public key of the ...
- 820
5
votes
What is the most secure way to store cross subdomain cookies
There are a few options.
One is simple third-party cookies; when the user authenticates, the server returns a page that makes simple requests - each with a short-lived, single-use, verifiable token - ...
- 52.1k
5
votes
Accepted
ARP spoofing + DNS spoofing
I think you misunderstood how such an attack works. You would not alter the default DNS server on the router after ARP spoofing. You could carry out an attack as following:
Become man-in-the-middle ...
- 620
4
votes
Modify the hosts file of the router and redirect trafic
Your goal could be accomplished easily and inexpensively on your home LAN with pi-hole. It allows you to direct DNS requests according to your needs, using a public resolver like Cloudflare or Google ...
- 181
4
votes
How could a public DNS server return bad results?
Since you are running Linux, an easy way around this without a full fledged VPN is SSH tunelling. If you can set up or get an account on a server in a neutral, unfiltered location, you can tunnel ...
- 141
4
votes
Accepted
DNS spoofing protection in Chrome and Firefox
Messenger.com is on the HSTS preload list. This means that it requires a https connection, for all browsers that use the HSTS preload list.
In addition, any browser which supports HSTS, but does not ...
- 17.5k
3
votes
DNS hijack redirect from one HTTPS hostname to another?
For example if I type in to my browser https://www.santanderbank.com and an attacker has taken over that DNS, can they redirect that to a valid https://www.santanderb4nk.com without the browser ...
- 208k
3
votes
DNS Spoof Adware
HTTPS does not prevent DNS spoofing, since these two protocols work at different layers and in fact HTTPS, because of the X.509 certificates that underline the Web PKI, need the DNS (both at ...
- 1,873
3
votes
How do I redirect HTTPS site to another HTTPS site over LAN using a linux?
This is possible with a proxy server (either configured on the client, or an invisible proxy with a MitM positon), or with spoofed DNS. However, in both cases you'll either need a certificate for the ...
- 52.1k
3
votes
Accepted
Cannot consistently demonstrate ARP Spoof and DNS Spoof?
Try just runnning arpspoof once using:
arpspoof -i enp0s3 -t 192.168.10.100 192.168.10.1 -r
-r poisons both hosts (host and target) to capture traffic in both directions, but is in your case not ...
- 146
2
votes
How does DNSSec work? Are there known limitations or issues?
You should probably read "Against DNSSEC" by Thomas Ptacek and its FAQ.
- 8,644
2
votes
DNSspoof not working
Referenced from @Samiec Omega's answer.
Another way to drop the packets directly is to match by source or destination IP address value:
$ sudo iptables --append FORWARD -s 192.168.1.17 --jump DROP
$ ...
- 161
2
votes
MITM attack DNS spoofing problem
Now with your comment I can understand a little bit more.
You are doing arpspoof, ok now the victim thinks you are the router... but to make a dns spoofing you need to be the dns of the victim. Is ...
- 5,365
2
votes
DNS hijack redirect from one HTTPS hostname to another?
My question is how did they do that, if you attempt access a website using https then can an attacker who controls the DNS for the hostname redirect your request to another https website without any ...
- 9,462
2
votes
Accepted
Active Directory DNS server security misconfiguration or an acceptable practice?
This should definitely be reported to your CSO and/or his/her team.
Besides you being able to add DNS records, chances are good, that you can execute other commands as well to manipulate the DNS ...
- 8,021
2
votes
DNS Poisoning - How to edit the "list" it in the target server?
One option is DNS cache poisoning - compromising a DNS server and changing entries there (making security.stackexchange.com point to the IP used by facebook.com). Clients of this server and other DNS ...
- 1,008
2
votes
Active Directory DNS server security misconfiguration or an acceptable practice?
UPDATE: I reported this issue to the Microsoft Security Response Center (Case 91434 on 24/9/2024). They responded on 5/11/2024 as follows (emphasis as in original):
Thank you again for submitting ...
- 125
2
votes
Accepted
To whom do I report this bizarre behavior (possibly hijacked website or DNS highjack)?
The owner of the website.
Showing malicious pages only in certain cases, instead of always, is a well-known pattern of infected sites/servers to make detection harder.
Random example, if the ...
- 3,874
2
votes
DNSSEC - does the domain owner owns a key?
At each level, in each zone, records are signed by one (or multiple) key, that is itself (the public part) in the zone as a DNSKEY record.
Also in parent zone a DS record (signed in the zone like any ...
- 1,873
Only top scored, non community-wiki answers of a minimum length are eligible