DNS Attacks - CompTIA Security+ SY0-701 - 2.4

Main ideas, concepts, and lessons

• DNS is critical for directing users to the correct IP addresses

  • DNS provides the mapping between a Fully Qualified Domain Name (FQDN) and an IP address.
  • If an attacker can interfere with DNS resolution, they can cause a user to reach an unintended/malicious destination.

• DNS poisoning attacks

  • Involve redirecting DNS responses so that users cache (or use) an incorrect IP address.
  • Two main attacker approaches:
    1. Modify the DNS server itself (harder for attackers because DNS servers are typically well protected)
    2. Modify the client’s local host file (more accessible, but still requires local access/elevated rights)

• Man-in-the-middle (MITM) DNS interception

  • An attacker can intercept DNS queries in real time and respond with results that redirect the user.
  • This requires the attacker to be “in the middle” during the DNS query.

• How attackers can gain control of DNS configuration

  • Scenario: attacker gains access to the DNS server

    • If an attacker compromises the DNS server (e.g., via vulnerability or stolen/admin credentials), they can change DNS records.
    • Result: future queries from other users return attacker-controlled IPs.

  • Scenario: attacker gains control of the domain registration

    • Attackers may target the place where the domain is registered/managed (domain registrar account).
    • With access, they can change the DNS settings (DNS-related IP mappings for that FQDN).
    • Common paths to registrar compromise mentioned:
      • Brute force
      • Social engineering
      • Leaked credentials (publicly released username/password combos)

  • Real-world example

    • Oct 22, 2016 at ~1 p.m.: attackers changed DNS settings for 36 domains tied to a bank in Brazil.
    • Impact: desktop/mobile/other associated devices were redirected during a period of about 6 hours.
    • Effect: attackers could collect usernames/passwords and financial data.
    • The bank reportedly had 5+ million customers and about $27B in assets.

• URL hijacking / typosquatting / brand jacking

  • Another method to redirect users to malicious content by exploiting mistyped or manipulated domain names.
  • Possible malicious outcomes:
    • Redirect to a site with ads (attacker earns ad revenue)
    • Use a near-identical misspelling to profit via domain selling (typo squatting/brand jacking)
    • Redirect to a competitor
    • Create a lookalike phishing page that captures credentials
    • Trick users into downloading malware, leading to ransomware or botnet enrollment

• Common domain-manipulation patterns

  • Misspelling characters (e.g., “Messer” vs a visually similar variant)
  • Omitting or adding letters
    • Example idea: forgetting the last “s” or adding extra letters (e.g., “mass.com” vs “messer.com”)
  • Different Top-Level Domain (TLD)
    • Same name but different ending (e.g., .com vs .org)
  • Lesson reinforced: don’t click email links blindly; verify the actual domain you’re visiting.

---

Methodology / “how attacks work”

DNS poisoning via DNS server modification (attacker compromises DNS)

• Attacker gains access to the DNS server (e.g., vulnerability, admin credentials).
• Attacker changes the DNS record for a target FQDN (e.g., professormesser.com).
• Instead of returning the legitimate IP (e.g., ...164), DNS returns an attacker-controlled IP (e.g., ...100).
• Subsequent user queries:
  • Users receive the poisoned IP
  • Users connect to the attacker’s machine rather than the legitimate site.

DNS poisoning via client host file modification

• Attacker targets the client computer.
• Attacker needs:
  • Access to the machine, and typically
  • Elevated rights to modify the hosts file.
• The client hosts file contains mappings of FQDN → IP (similar to DNS server records).
• If a requested domain matches an entry in hosts:
  • The system uses that cached mapping
  • It does not query the DNS server for that entry.

DNS poisoning via man-in-the-middle interception

• Attacker positions themselves to intercept DNS queries while they occur.
• When the DNS query is made, attacker returns a forged DNS response.
• The user is directed to an incorrect/malicious IP in real time.

Redirecting via domain registrar compromise

• Attacker compromises the domain registration account.
• Methods mentioned:
  • Brute force
  • Social engineering
  • Using leaked credentials (publicly available username/password)
• Attacker updates DNS settings for the domain.
• Traffic for the domain is redirected according to the new DNS configuration.

URL hijacking / typo squatting / brand jacking

• Attacker uses domains that are:
  • Misspelled variants of legitimate domains, or
  • Similar enough to be mistaken at a glance.
• Mechanisms described:
  • Remove/add letters
  • Replace visually similar characters
  • Change the TLD (.com vs .org)
  • Register domains with common “mistyped” keyboard patterns
• Outcomes include:
  • Ad-based revenue pages
  • Selling domains to the legitimate owner
  • Redirecting to competitors
  • Phishing credential capture
  • Malware delivery (ransomware/botnet)

---

Speakers / sources featured

• No specific named speaker is identified in the provided subtitle text.
• Source context: CompTIA Security+ SY0-701 training content (implied by video title only).