dns.victim.com DNS server using the Kaminsky method of DNS cache poisoning. Of the following choices, which would be an example of an effective query sent by the attacker?

Question

Options

• Aredherring.dns.org
• Bgreedy.moneybags.com
• Cbogus.victim.com
• Dhelp.evil.org

• A
  10% (4)
• B
  5% (2)
• C
  12% (5)
• D
  73% (30)

Explanation

The Kaminsky DNS cache poisoning attack works by flooding a target DNS resolver (here, dns.victim.com) with queries for random, nonexistent subdomains of a domain the attacker wants to poison. The attacker sends queries like 'help.evil.org' (a random subdomain of evil.org) to dns.victim.com. Since dns.victim.com has no cached answer, it must perform a recursive lookup - querying evil.org's authoritative nameservers. While dns.victim.com is waiting for a real response, the attacker floods it with thousands of forged responses pretending to be from evil.org's authoritative server, trying to win a race to inject a poisoned record (e.g., redirecting evil.org to an attacker-controlled IP). Option C (bogus.victim.com) would not work because dns.victim.com is likely authoritative for victim.com and would answer locally, providing no recursive lookup opportunity and no opening for cache poisoning.

No community discussion yet for this question.