DNS hijacking

From Wikipedia, the free encyclopedia

DNS hijacking is the practice of hijacking the resolution of DNS names to IP addresses by the use of rogue DNS servers, particularly for the practice of phishing.

[edit] Rogue DNS server

A rogue DNS server translates legitimate domain names (of search engines, online banks, online brokers, etc.) into IP addresses of malicious websites. Most users depend on DNS servers automatically assigned by their ISPs. Zombie computers use DNS-changing trojans to invisibly switch the automatic DNS server assignment by the ISP to manual DNS server assignment from rogue DNS servers. When users then try to visit legitimate domain names, they are sent to malicious websites that may masquerade as legitimate websites in order to fradulently obtain sensitive information, also known as phishing.^[1]

[edit] See also

• Domain hijacking
• Domain name system (DNS)
• Automatic assignment of DNS servers:
  • Dynamic Host Configuration Protocol (DHCP)
  • Point-to-Point Protocol (PPP)
• Phishing

[edit] References