RE: DNS Hijack Attacks

["Norman Girard" <ngirard () qualys com>]

Hey Richard,

You should search for DNS Cache Poisoning.

A pretty good document will provide you a lot of information :

http://www.lurhq.com/dnscache.pdf


Regards,
Norman


Norman Girard 
ngirard () qualys com 
Senior Security Engineer 
Western Region 
Qualys, Inc (www.qualys.com) 
1600 Bridge Parkway 
Redwood Shores, CA 94063 
Tel : +1 650 801 6168 
Fax : +1 650 801 6101 
Cell : +1 650 868 1138 
"On-Demand Security Audits and Vulnerability Management Service for the Enterprise". 



-----Original Message-----
From: Richard Maudsley [mailto:r_i_c_h () btopenworld com]
Sent: Tuesday, November 25, 2003 12:58 PM
To: full-disclosure () lists netsys com
Subject: [Full-disclosure] DNS Hijack Attacks


Hello,

Sorry about this post.

I've been trying to find information about DNS Hijack attacks for ages. I
can't seem to find anything about them.

Am I right in thinking that this attack is where a DNS server is broken into
and the routing table modified so that a domain name points to a different
server where the content is controlled by the attacker?

Could anyone point me in the right direction for more information. I was
hoping for a whitepaper or something...

Regards,
    Richard

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html