ITPEC FE Morning October 2020 Question 35

False records injected into a DNS server lead the user to a fake server — cache poisoning corrupts the answers a DNS server has stored.

A caching DNS server keeps the answers it receives so it can reply to later queries directly. In cache poisoning the attacker gets a forged answer accepted, for example by racing a spoofed reply against the real one, so the cache maps a legitimate domain name to the attacker's IP address. Every PC that uses that DNS server is then sent to the fake server until the entry expires.

Answer (a)

Why not others:

• •(b) — reading the DNS software's version to find a known vulnerability is fingerprinting, reconnaissance before an attack
• •(c) — sending masses of recursive queries through a DNS server to swamp a target is a DNS amplification (reflection) DoS attack
• •(d) — copying a server's zone information to learn internal host names is an abuse of zone transfer, a reconnaissance attack

Key rule: Poisoning changes what a server believes rather than overloading or probing it; the defences are source-port randomisation, allowing recursion only for trusted clients, and DNSSEC signatures.

Security · AI-written, may contain errors