Re: More on ARP cache poisoning

[forrestc () IMACH COM (Forrest W. Christian)]

On Tue, 1 Feb 2000, Clifford, Shawn A wrote:

> So, this pretty much makes moot hijacking the SETI download, etc.  You can
> ony use the ARP poison to redirect connections _within_ or LAN.

Much easier is "cache poisioning" the client's DNS server.

Send request for the A record of seti@home's server, and also send a
forged response.

Now when the client asks for the seti@home address, it turns around and
asks your server for it instead, because it got the IP address you stuffed
in the client's DNS server.

- Forrest W. Christian (forrestc () imach com) KD7EHZ
----------------------------------------------------------------------
iMach, Ltd., P.O. Box 5749, Helena, MT 59604      http://www.imach.com
Solutions for your high-tech problems.                  (406)-442-6648
----------------------------------------------------------------------