However, it might solve the first problem mentioned by “ poisoning” a DNS server. If it’s encrypted, it’s going to take a lot more time and effort and might never be able to guess the credentials. Ģ) The communications would be unencrypted (the address bar would still be white, while it should be yellow)Īn attacker won’t encrypt the communications, since the main goal is to steal the username and password. For example, by clicking a link to go on the Royal Bank of Canada, the address bar of the browser could display something like: or instead of. If someone was to navigate to this website, it would see that:ġ) The address bar would show either some IP address or a fake name server. Up to this point, the attacker has a web server hosting a copy of a legitimate website, but it has two major flaws. It can also easily set up one using open source software such as Apache. It can either be use a free one offered by various providers or by criminal hosting companies. Once an attacker has a copy of the website, it needs to upload it to an illegimate web server. Multiple tools are available on the net to download entire websites page to page. Legitimate sites usually copied are banks, MMORPGs, online retailers or social network websites. Here are the mechanics of the attack:įirst, one needs to set up a fake website by ripping a legitimate one and doing a mirror copy of it. This time, the variants try to bypass the DNS addresses used by ADSL modems used by home networks. It also used to change the HOSTS file to map specific domains to malicious IP address. It modified and would modify the internal settings of the OS by changing the Primary and Secondary DNS address property in the “Internet Protocol” settings of the network card. The first strains of the DNSChanger worm infected Windows and Mac machines. The attack used is quite interesting, but far from being new mind you.

A variant of the DNSChanger worm is reported to use DNS poisoning to infect new machines on a network, according to a well explained article from the The Register.

Dns worm virus