2 cissp ® Official Study Guide Eighth Edition

DNS Poisoning, Spoofing, and Hijacking
DNS poisoning
and 
DNS spoofing
are also known as resolution attacks. Domain Name 
System (DNS) poisoning occurs when an attacker alters the domain-name-to-IP-address 
mappings in a DNS system to redirect traffic to a rogue system or to simply perform a denial 
of service against a system. DNS spoofing occurs when an attacker sends false replies to a 
requesting system, beating the real reply from the valid DNS server. This is also technically 
an exploitation of race conditions. Protections against false DNS results caused by poison-
ing and spoofing include allowing only authorized changes to DNS, restricting zone trans-
fers, and logging all privileged DNS activity.
In 2008, a fairly significant vulnerability was discovered and disclosed to the world 
by Dan Kaminsky. The vulnerability lies in the method by which local or caching DNS 
servers obtain information from root servers regarding the identity of the authoritative 
servers for a particular domain. By sending falsified replies to a caching DNS server for 
nonexistent subdomains, an attacker can hijack the entire domain’s resolution details. 
For an excellent detailed explanation on how DNS works and how this vulnerability 
threatens the current DNS infrastructure, visit “An Illustrated Guide to the Kaminsky 
DNS Vulnerability” located at 
http://unixwiz.net/techtips/iguide-kaminsky-dns-
vuln.html
.
Another DNS concern is that of the Homograph attack. These attacks leverage 
similarities in character sets to register phony international domain names (IDNs) that
to the naked eye appear legitimate. For example, some letters in Cyrillic look like Latin 
characters; for example, the 
p
in Latin looks like the Palochka Cyrillic letter. Thus,
domain names of apple.com and paypal.com might look valid as Latin characters but actu-
ally include Cyrillic characters that when resolved direct you to a different site than which 
you intended. For a thorough discussion of the Homograph attack, see 
https://blog 
.malwarebytes.com/101/2017/10/out-of-character-homograph-attacks-explained/
.
The only real solution to this DNS hijacking vulnerability is to upgrade DNS to Domain 
Name System Security Extensions (DNSSEC). For details, please visit 
dnssec.net
.