DNS Cache Poisoning: What Every SMB Must Know

In one of the most common poisoning attacks, the attacker poisons the DNS cache with the aim of leading visitors to a fake website. The attacker gains control of the DNS server and then manipulates cache data such that anyone typing the URL of an actual website is redirected to a fake one. This could be a phishing site where the attacker would have carefully laid out a trap to capture the unsuspecting victim’s personal data or secure information. For example, the visitor thinks they are logging into their bank’s website online, but are actually on the attacker’s phishing site, where they enter the login credentials.

Protecting yourself against DNS poison attacks
Here are some ways to protect yourself and your customers from becoming victims of DNS poison attacks.

1. As discussed before, one of the most common poisoning attacks is the DNS attacks. Cybercriminals try to corrupt your DNS server using theirs. You can prevent this by bringing a trained professional onboard for your DNS server setup. An expert will know to set up your DNS server such that it has a minimum relationship with other, external DNS servers, thus limiting your attacker’s ability to corrupt your DNS server using theirs.
2. As a best practice, ensure that your DNS servers only store data related to your domain and not any other information. It is harder to corrupt the system when it focuses on a single element.
3. Another best practice is to ensure that you are up-to-date on all DNS security mechanisms and are using the most recent version of the DNS.
4. Ensure your site has, in layman terms, an SSL certificate and make sure it is HTTPS. Using encryption, a site with HTTPS protocol allows for a more secure connection between its server and the internet and is better at keeping cybercriminals out. Having an SSL certificate also ensures your site’s name shows up alongside the URL in the address bar. This is an easy way for visitors to identify if they are on a genuine site or not, thus helping them steer clear of phishing attacks and clone sites.

Data poisoning is one of the lesser-known and hence less talked about forms of cybercrime, but it can inflict great damage–perhaps even more damage than the other obvious threats such as viruses and ransomware. Unlike a Denial of Service (DoS) attack or a Ransomware attack where you know the moment the malware has hit your system, in a data poisoning attack, the malware is incorrect data that slithers into your system quietly like a snake and changes its overall functioning before delivering the big blow.

There are layers of protection which can be added to client computers to protect them from a DNS poisoning attack when they are outside your network. We offer DNS protection and would be glad to talk to you about it.