Nt1330 Unit 3 Assignment 1 Remote Host Name Spoofing

Rogue DNS servers pose a threat to the Internet community because the information these servers contain may not be trustworthy [SPAF]. They facilitate attack techniques such as host name spoofing and DNS spoofing. Host name spoofing is a specific technique used with PTR records. It differs slightly from most DNS spoofing techniques in that all the transactions that transpire are legitimate according to the DNS protocol while this is not necessarily the case for other types of DNS spoofing. With host name spoofing, the DNS server legitimately attempts to resolve a PTR query using a legitimate DNS server for the zone belonging to that PTR. It’s the PTR record in the zone’s data file on the primary server that is purposely configured to point

This bogus information is sent as either the answer or as just a helpful hint and gets cached by the unsuspecting DNS server. One way to coerce a susceptible server into obtaining the false information is for the attacker to send a query to a remote DNS server requesting information pertaining to a DNS zone for which the attacker’s DNS server is authoritative. Having cached this information, the remote DNS server is likely to misdirect legitimate clients it serves

Kashpureff injected bogus information into DNS caches around the world concerning DNS information pertaining to Network Solutions Inc.’s (NSI) Internet’s Network Information Center (InterNIC). The information redirected legitimate clients wishing to communicate with the web server at the InterNIC to Kashpureff’s AlterNIC web server. Kashpureff did this as a political stunt protesting the Internic’s control over DNS domains. When the attack occurred in July of 1997, many DNS servers were injected with this false information and traffic for the Internic went to AlterNIC where Kashpureff’s web page was filled with the propaganda surrounding his motives and objections to InterNIC’s control over the DNS