DNS Spoofing (Forged responses)

 

---

1. DNS Spoofing (Forged responses)

What it means

DNS spoofing is when an attacker sends a fake DNS response pretending to be the real one, tricking a resolver or client into accepting it.

Because classic DNS has no cryptographic verification, the system mainly relies on:

• Matching transaction ID

• Matching source IP/port expectations

• Timing (who replies first “wins”)

That’s weak by design.

---

How spoofing works (step-by-step)

Imagine you request:

www.bank.com → ?

1. Your device sends a DNS query to a resolver:

   • “What is the IP of www.bank.com?”

2. Before the real response arrives, an attacker:

   • Guesses or observes the query

   • Sends a forged DNS reply like:

     • www.bank.com → 6.6.6.6 (attacker site)

3. If the forged response arrives first and matches expected metadata:

   • The resolver accepts it

   • It may even cache it (if cache poisoning succeeds)

4. You are redirected to a fake website.

---

Key idea

Spoofing works because DNS:

• Does not verify identity of responder

• Treats “plausible answer” as “correct answer”

---

Why it’s dangerous

• Phishing attacks (fake banking/login pages)

• Malware distribution

• Silent redirection (user thinks site is real)

---

2. On-path manipulation (Man-in-the-middle DNS attack)

What it means

An on-path attacker is someone who can sit between you and the DNS resolver (or between resolver and authoritative server) and intercept or modify traffic in real time.

This is often called a:

• Man-in-the-middle (MITM) attack

---

Where “on-path” attackers exist

They may be able to intercept DNS traffic if they control:

• Public Wi-Fi networks

• ISP infrastructure (in some cases)

• Compromised routers or gateways

• Corporate networks

• Local network attackers (same LAN)

---

How on-path manipulation works

1. You send a DNS query:

   • “What is www.bank.com?”

2. The attacker sees this query in transit (because DNS is usually unencrypted UDP)

3. They have two main options:

A. Modify the response (active manipulation)

• Let the real request go through

• But intercept the response coming back

• Replace it with:

  • Fake IP address (attacker-controlled server)

B. Inject a faster fake response

• Respond before the real DNS server does

• Similar to spoofing, but with network visibility advantage

---

Result

You receive:

www.bank.com → attacker IP

Even though the real DNS server might have responded correctly.

---

Key difference from spoofing

Feature	Spoofing	On-path manipulation
Attacker position	Off-path (not in network flow)	On-path (can observe traffic)
Visibility of queries	Limited/guessed	Full visibility
Ability to modify traffic	No	Yes
Success rate	Lower	Higher

---

Why DNS design allows both attacks

Both attacks exploit the same core weaknesses:

1. No authentication

DNS doesn’t cryptographically prove:

• “This response is from the real authoritative server”

2. No integrity protection

Responses can be altered without detection.

3. Unencrypted transport (classic DNS)

DNS over UDP/TCP in its traditional form:

• Is visible to anyone on the network path

• Can be intercepted or injected into

---

How modern systems mitigate this

DNSSEC (fixes authenticity)

• Adds cryptographic signatures

• Prevents forged responses being accepted

DoH / DoT (fixes transport security)

• Encrypts DNS traffic

• Prevents on-path attackers from seeing/modifying queries

But important nuance:

• DNSSEC protects data correctness

• DoH/DoT protects communication privacy

• You often need both for full protection

---

One-line intuition

• Spoofing = attacker guesses and lies faster than the real server

• On-path manipulation = attacker stands on the wire and edits the truth in real time

---