DNS poisoning

Domain Name Service (DNS) is one of the most critical services on the Internet. Everyone routinely uses domain names, which DNS translates into the IP addresses that programs actually use to reach other systems. Erroneous or fake DNS data can cause all kinds of problems.

Normally, when a program wants to obtain an IP address (or possibly other data) for a domain name, it generates query to a DNS server. Often that server has to relay that query to other DNS servers (a "recursive query"), and to save network resources and time DNS data is frequently cached by servers.

Until recently, the most commonly-used DNS server software would cache all data returned in a reply. This meant that an evilly-configured DNS server could return additional data in a reply beyond the answer to the original query, and a naive DNS server would cache this data and, believing it was valid, return it for answers to queries for those domains.

This could allow the evil DNS server to insert bogus data for a domain like "www.bigbank.com" which directed clients to an IP address different from www.bigbank.com's real IP address; this other IP address could do something like proxy traffic between the client and the real www.bigbank.com, and intercept data (like account or credit card numbers) passing through the session.

This is just one example of the kinds of mischief that were possible with DNS poisoning attacks. In general, poisoning would allow a malicious DNS server operator to misdirect some fraction of the traffic to a legitimate site, if not to intercept it, then just to annoy the legitimate site's owners.

Since then DNS server caching has added sanity checks to ignore data in a reply that is not relevant to the original query.


Steve VanDevender
Last modified: Tue Aug 3 13:17:33 PDT 2004