Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

my isp has spoofed dns ips(like 8.8.8.8). so when i request for some names(like google.com) it sends me some wrong ip addresses. this is the situation:

nslookup youtube.com 8.8.8.8
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   youtube.com
Address: 10.10.34.34

when i encrypt my dns queries it's just fine. is it called 'dns hijacking' or dns cache poisoning?

share|improve this question
    
What your ISP is doing is exactly what "dns hijacking" is. I would use an alternative DNS provider to solve that problem. –  Ramhound Nov 26 '12 at 12:55

2 Answers 2

It's probably cache poisoning - that's where someone sends lots of DNS responses to a server hoping to have one of them accepted instead of a valid response from an upstream server. Then for a while the DNS server will serve that spoofed response from its own cache.

Have a read here for more info: http://en.wikipedia.org/wiki/DNS_spoofing

share|improve this answer
    
and what is exactly the dns hijacking? –  sia Oct 17 '12 at 21:09
    
Well - according to Wikipedia ;) it's this: "DNS hijacking or DNS redirection is the practice of subverting the resolution of Domain Name System (DNS) queries. This can be achieved by malware that overrides a computer's TCP/IP configuration to point at a rogue DNS server under the control of an attacker, or through modifying the behaviour of a trusted DNS server so that it does not comply with internet standards." –  ed. Oct 17 '12 at 21:18

Actually in this case it's DNS hijacking, not DNS cache poisoning.

The difference between DNS hijacking and DNS poisoning is who the responder of the DNS request is.

In the case of DNS hijacking, your machine makes a request to an upstream DNS provider asking "where is www.google.com" and it responds "www.google.com is at 2.3.4.5" without bothering to find out where it actually lives. This is in contrast with a normal DNS request where the DNS server would either query the real address from its cache or an upstream provider and then tell you with whom you need to connect to reach www.google.com.

DNS cache poisoning is where someone else's machine sends a request to your upstream provider asking "where is www.google.com". When that machine requests www.google.com from its upstream provider, the attacker then tries to "race" the DNS response. So the poisoner effectively asks "where is www.google.com" and then throws lots of "www.google.com is at 2.3.4.5" at your upstream DNS provider. If one of them "sticks", your upstream DNS will think that www.google.com is at 2.3.4.5 and will cache the response.

Now, when you make a request to your upstream DNS provider, instead of it asking its upstream provider, it "knows" (i.e. has cached) that www.google.com is at 2.3.4.5 - a domain owned by the attacker.

But in your particular case, you're not being attacked. Your ISP is deliberately misreporting where www.google.com is in order to redirect you to an internet gateway portal, rather than to steal your private information or hijack your cookies. Alternatively (since we're talking about youtube), your ISP might have an agreement with Google to host some content geographically closer to you to reduce the load on the ISP, which might require your ISP to "spoof" youtube to a false address within the ISP network.

So in summary, you're being DNS hijacked, but almost certainly not maliciously.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.