CAPEC-598: DNS Spoofing

An adversary sends a malicious (NXDOMAIN (No such domain) code, or DNS A record) response to a target's route request before a legitimate resolver can. This technique requires an On-path or In-path device that can monitor and respond to the target's DNS requests. This attack differs from BGP Tampering in that it directly responds to requests made by the target instead of polluting the routing the target's infrastructure uses.

Severity:

Possibility:

Extended Description

No Extended Description.

Mitigations

Design: Avoid dependence on DNS

Design: Include hosts file/IP address in the application

Implementation: Utilize a .onion domain with Tor support

Implementation: DNSSEC

Implementation: DNS-hold-open

Relationships with other CAPECs

CAPEC-194: Fake the Source of Data

Details

Prerequisites

On/In Path Device

Related Weaknesses

No related Weaknesses found.