DNS spoofing

Domain name system (DNS) spoofing is a type of cyber attack that uses tampered DNS server data to redirect users to fake websites. These malicious sites often look legitimate but are actually designed to install malware onto users’ devices, steal sensitive data or redirect traffic.

Before diving into how DNS spoofing attacks work, it’s important to understand how a DNS system operates. When a user searches for a website using a URL (Uniform Resource Locator), their device sends the request to a DNS server that matches the URL to the associated IP address — a unique string of numbers and periods assigned to every device, server and website.

Once the DNS server pairs the request to an IP address, the system directs the user to the requested site. Unfortunately, DNS records are not very secure, and attackers can exploit their vulnerabilities to perform DNS spoofing attacks.

In this article, we’ll explain how DNS spoofing works and provide strategies to identify and protect yourself from an attack.

How Does DNS Spoofing Work?

There are a few methods attackers can use to execute DNS spoofing attacks, but they all share the same goal — to trick users and their servers into thinking a fraudulent website is legitimate. To do this, attackers typically follow these four steps:

Step 1: Accessing the DNS server

Before a hacker can perform this attack, they need to gain access to the DNS server or DNS resolver cache. This process involves identifying a DNS server’s software versioning and MAC address, scanning for vulnerabilities and determining whether it uses DNSSEC (domain name system security extensions) or DNS encryption. Unfortunately, most DNS queries and responses are unprotected, making it easy for attackers to gain access and redirect traffic to a server they control.

Step 2: Rerouting Connections

Once the attacker has access to a DNS server or resolver, they can replace stored IP addresses with fake ones. Because these systems can’t differentiate between a legitimate IP address and a malicious one, attackers can trick them into storing a spoofed entry that leads to a malicious website. Once this process is complete, the spoofed entry remains in the system and directs anyone connected to the server to the malicious site instead of the legitimate one.

Step 3: Accessing Sensitive Data

Once a user arrives at a malicious website, it may prompt them to enter their login information like they normally would. Because the fake site looks exactly like the legitimate one, the victim has no idea that they are handing sensitive information over to the attacker. Attackers can also use DNS spoofing to install malware on a user’s device or redirect traffic to phishing websites. This is especially common for online shopping and banking websites.

DNS cache poisoning example

The following example illustrates a DNS cache poisoning attack, in which an attacker (IP 192.168.3.300) intercepts a communication channel between a client (IP 192.168.1.100) and a server computer belonging to the website www.estores.com (IP 192.168.2.200).

In this scenario, a tool (e.g., arpspoof) is used to dupe the client into thinking that the server IP is 192.168.3.300. At the same time, the server is made to think that the client’s IP is also 192.168.3.300.

Such a scenario would proceed as follows:

The attacker uses arpspoof to issue the command: arpspoof 192.168.1.100 192.168.2.200. This modifies the MAC addresses in the server’s ARP table, causing it to think that the attacker’s computer belongs to the client.
The attacker once again uses arpspoof to issue the command: arpspoof 192.168.2.200 192.168.1.100, which tells the client that the perpetrator’s computer is the server.
The attacker issues the Linux command: echo 1> /proc/sys/net/ipv4/ip_forward. As a result, IP packets sent between the client and server are forwarded to the perpetrator’s computer.
The host file, 192.168.3.300 estores.com is created on the attacker’s local computer, which maps the website www.estores.com to their local IP.
The perpetrator sets up a web server on the local computer’s IP and creates a fake website made to resemble www.estores.com.
Finally, a tool (e.g., dnsspoof) is used to direct all DNS requests to the perpetrator’s local host file. The fake website is displayed to users as a result and, only by interacting with the site, malware is installed on their computers.

See how Imperva DDoS Protection can help you with DNS spoofing attacks.

[Request demo](javascript:openModal%28'modalid3533',%20'/learn/banner/virtual/request-demo/',%20'Personal%20Demo%20Request%20|%20Imperva'%29;)Learn more

DNS spoofing mitigation using domain name server security (DNSSEC)

DNS is an unencrypted protocol, making it easy to intercept traffic with spoofing. What’s more, DNS servers do not validate the IP addresses to which they are redirecting traffic.

DNSSEC is a protocol designed to secure your DNS by adding additional methods of verification. The protocol creates a unique cryptographic signature stored alongside your other DNS records, e.g., A record and CNAME. This signature is then used by your DNS resolver to authenticate a DNS response, ensuring that the record wasn’t tampered with.

While DNSSEC can help protect against DNS spoofing, it has a number of potential downsides, including:

Lack of data confidentiality – DNSSEC authenticates, but doesn’t encode DNS responses. As a result, perpetrators are still able to listen in on traffic and use the data for more sophisticated attacks.
Complex deployment – DNSSEC is often misconfigured, which can cause servers to lose the security benefits or even deny access to a website altogether.
Zone enumeration – DNSSEC uses additional resource records to enable signature validation. One such record, NSEC, is able to verify the non-existence of a DNS zone. It can also be used to walk through a DNS zone to gather all existing DNS records—a vulnerability called zone enumeration. Newer versions of NSEC, called NSEC3 and NSEC5, publish hashed records of hostnames, thereby encrypting them and preventing zone enumeration.