What Is DNS Poisioning?

With man-in-the-middle (MITM) duping, the attacker gets between the web browser you are using and the DNS server. They then use a tool to alter the information in the cache on your device, as well as the information on the DNS server. You then get redirected to a malicious site.

When hijacking a DNS server, the attacker makes adjustments to the server, causing it to direct users to a malicious site. The fake DNS information causes every user who enters that website’s address to get sent to the fraudulent site.

When an attacker uses spam for DNS spoofing attacks, they put the code used for the cache poisoning inside an email. The email will often try to scare users into clicking on the link that ends up launching the DNS poisoning attack.

An attacker can have the user redirected to a phishing website that can collect the user’s private information. When the user enters it, it gets sent to the attacker, who can then use it or sell it to another criminal.

A cyber criminal may have the user sent to a website that infects their computer with malware. This can be done through drive-by downloads, which automatically put the malware on the user’s system or through a malicious link on the site that installs malware, such as a Trojan virus or a botnet.

An attacker can spoof an internet security provider’s site. This way, when the computer attempts to visit the site to update its security, it will be sent to the wrong one. As a result, it does not get the security update it needs, leaving it exposed to attacks.

Censorship can be executed via manipulation of the DNS as well. For instance, in China, the government changes the DNS to make sure only approved websites can be viewed within China.

FortiGuard Labs provides users of Fortinet security products with advanced threat intelligence. The information is gathered by threat hunters, analysts, data scientists, engineers, and researchers who specialize in identifying and stopping attacks. This enables Fortinet products to detect DNS poisoning attacks and protect users from their impact.

Domain Name System (DNS) poisoning refers to when fake information is entered into the cache of a domain name server, resulting in DNS queries producing an incorrect reply, sending users to the wrong website.

A DNS lists the Internet Protocol (IP) addresses associated with domain names, or the names of websites. A DNS server keeps track of the domain names and their associated IP addresses and sends users to the IP address associated with the website name they typed in.

The risks of DNS poisoning include data theft, malware infection, delayed security updates, and censorship.

To prevent DNS poisoning, you can use DNS spoofing detection, DNS security extensions, and end-to-end encryption. You can also not click on suspicious links, regularly scan your computer for malware, flush your DNS cache, and use a virtual private network (VPN).