DNS Cache Poisoning

[seojunkie]

Over at WebMasterWorld, pageoneresults pointed out the old problem of DNS cache poisoning has again reared its ugly head. According to the thread;

Sub-Attacks

Once an attacker has managed to poison a DNS cache, there are a number of ways they can subvert protocols that rely on DNS. Some of the potential methods are listed below.

Redirecting Web Traffic
An attack of this nature might range from a simple annoyance to a financial nightmare for a great number of people. The goal here is to set up a website that looks enough like the original so as to not raise any suspicion. Then the domain is hijacked via cache poisoning for as many ISPs/companies as possible, causing their traffic to hit the phony site instead. Some of the sub-attacks here are:

Redirect a popular search engine to a pop-up ad site.

Redirect a bank website to gain access to account passwords.

Redirect news site to inject false stories and manipulate stocks.

The poster thinks that this problem is even more critical and proposes one read the following:

DNS Recursion - Open DNS Servers
http://www.webmasterworld.com/forum23/4488.htm

Links Hijacked in Search Engines
http://www.webmasterworld.com/forum5/7481.htm

Run a DNS Report Now!
http://www.dnsreport.com/

SANS - Internet Storm Center
http://isc.sans.org/presentations/dnspoisoning.php