Editing DNS spoofing (section)

==Cache poisoning attacks==
Normally, a networked computer uses a DNS server provided by an Internet service provider (ISP) or the computer user's organization. DNS servers are used in an organization's network to improve resolution response performance by caching previously obtained query results. Poisoning attacks on a single DNS server can affect the users serviced directly by the compromised server or those serviced indirectly by its downstream server(s) if applicable.<ref>{{Cite journal|last=Storms|first=Andrew|date=2006|title=Don't Trust Your Vendor's Software Distribution Methodology|journal=Information Systems Security|volume=14|issue=6|pages=38–43|doi=10.1201/1086.1065898X/45782.14.6.20060101/91858.8|s2cid=15167573|via=ProQuest Central}}</ref>

To perform a [[cache poisoning]] attack, the attacker [[Exploit (computer security)|exploit]]s flaws in the DNS software.  A server should correctly validate DNS responses to ensure that they are from an authoritative source (for example by using [[DNSSEC]]); otherwise the server might end up caching the incorrect entries locally and serve them to other users that make the same request.

This attack can be used to redirect users from a website to another site of the attacker's choosing.  For example, an [[Spoofing attack|attacker]] [[IP address spoofing|spoofs]] the IP address DNS entries for a target website on a given DNS server and replaces them with the IP address of a server under their control. The attacker then creates files on the server under their control with names matching those on the target server. These files usually contain [[Malware|malicious]] content, such as [[computer worm]]s or [[computer virus|viruses]]. A user whose computer has referenced the poisoned DNS server gets tricked into accepting content coming from a non-authentic server and unknowingly downloads the malicious content. This technique can also be used for [[phishing]] attacks, where a fake version of a genuine website is created to gather personal details such as bank and credit/debit card details.

The vulnerability of systems to DNS cache poisoning goes beyond its immediate effects as it can open users up to further risks such as [[phishing]], [[malware]] injections, [[Denial-of-service attack|denial of service]], and website hijacking due to system vulnerabilities. Various methods, ranging from the use of [[Social engineering (security)|social engineering]] tactics to the exploitation of weaknesses present in the DNS server software, can lead to these attacks.<ref>{{Cite book |chapter=DNS Cache Poisoning: A Review on its Technique and Countermeasures  |chapter-url=https://ieeexplore.ieee.org/document/8550085 |access-date=2024-01-31 |date=2018 |doi=10.1109/NITC.2018.8550085 |last1=m. Dissanayake |first1=I. M. |title=2018 National Information Technology Conference (NITC) |pages=1–6 |isbn=978-1-5386-9136-6 }}</ref>