0

I'm giving a presentation to explain how a hostname is resolved into an IP address and all of the complexities involved. I also would like to talk about all of the problems that can happen that could affect the integrity of the resolution.

I'm hoping to get some feedback to say what I have right and wrong. I'm not looking for solutions or discussions on DNSSEC, I just want to characterize the normal "vanilla" case that a home user would experience.

When a computer wishes to resolve a hostname it:

  • Looks in the hosts file, which is a file whose location is OS specific.
  • If the hosts file does not contain an entry, then a DNS server needs to be queried. The OS allows you to configure which DNS Server to use and if one has been configured, that's what will be used.
  • If no DNS server is configured at the OS level, then the DNS server configured at the router will be used.
  • If the router has no configured DNS server, then the DNS server configured by the ISP will be used.

And yes, there will be caching happening at each level. Let's just ignore this.

So what can go wrong? The choice of DNS server used can be hijacked anywhere along the route. It can be hijacked by:

  • Malware in the computer
  • Malware in the router
  • Another entity running a computer somewhere along the route such as a hacker, ISP or government body.

So how well have I characterized the process and the threats? What have I missed?

1 Answer 1

1

Regarding the DNS, the OS is configured with the dns server to query. Either it is configured statically or dynamically by DHCP. Thus, when a computer/OS wants to resolve a host, it only uses what is already configured and not searching for a dns server that is configured in the router/ISP.

Not the answer you're looking for? Browse other questions tagged .