DNS poisoning in Computer Networks - Mini Project: Build & Apply

Understanding DNS Poisoning

📖 Scenario: You are learning about how the internet translates website names into IP addresses using the Domain Name System (DNS). Sometimes, attackers try to trick this system by changing the address information, which is called DNS poisoning.In this project, you will build a simple example to understand how DNS poisoning works by creating a small DNS table, setting a trusted domain, simulating an attack, and then fixing the table.

🎯 Goal: Build a simple DNS table and simulate a DNS poisoning attack by changing the IP address of a trusted domain. Then, restore the correct IP address to understand how DNS poisoning can be detected and fixed.

📋 What You'll Learn

Create a dictionary representing a DNS table with domain names and their IP addresses

Add a variable to store the trusted domain name

Simulate DNS poisoning by changing the IP address of the trusted domain

Restore the correct IP address to complete the DNS table

💡 Why This Matters

🌍 Real World

DNS poisoning is a real threat that can redirect users to fake websites, causing security risks like data theft or malware infection.

💼 Career

Understanding DNS poisoning helps network administrators and cybersecurity professionals protect internet users by detecting and preventing such attacks.

1

Create the DNS table

Create a dictionary called dns_table with these exact entries: 'example.com': '93.184.216.34', 'openai.com': '104.18.30.162', and 'testsite.com': '192.0.2.1'.

Computer Networks

# Create the dns_table dictionary with domain names and IP addresses
# Your code here

Hint

Use curly braces {} to create a dictionary with keys as domain names and values as IP addresses.

2

Set the trusted domain

Create a variable called trusted_domain and set it to the string 'example.com'.

Computer Networks

dns_table = {
    'example.com': '93.184.216.34',
    'openai.com': '104.18.30.162',
    'testsite.com': '192.0.2.1'
}
# Create the trusted_domain variable and set it to 'example.com'
# Your code here

Hint

Assign the string 'example.com' to the variable trusted_domain.

3

Simulate DNS poisoning attack

Change the IP address of the domain stored in trusted_domain inside dns_table to '123.45.67.89' to simulate DNS poisoning.

Computer Networks

dns_table = {
    'example.com': '93.184.216.34',
    'openai.com': '104.18.30.162',
    'testsite.com': '192.0.2.1'
}
trusted_domain = 'example.com'
# Change the IP address of the trusted_domain to '123.45.67.89' to simulate poisoning
# Your code here

Hint

Use the variable trusted_domain as the key to update the IP address in dns_table.

4

Restore the correct IP address

Change the IP address of the domain stored in trusted_domain inside dns_table back to the original IP '93.184.216.34' to fix the DNS poisoning.

Computer Networks

dns_table = {
    'example.com': '93.184.216.34',
    'openai.com': '104.18.30.162',
    'testsite.com': '192.0.2.1'
}
trusted_domain = 'example.com'
dns_table[trusted_domain] = '123.45.67.89'
# Restore the IP address of trusted_domain to '93.184.216.34'
# Your code here

Hint

Assign the original IP address back to the key stored in trusted_domain in dns_table.

Practice

1. What is the main goal of DNS poisoning in computer networks?

easy

A. To block access to certain websites

B. To redirect users to fake websites by giving wrong IP addresses

C. To encrypt DNS queries for security

D. To speed up the DNS lookup process

Solution

1. Step 1: Understand DNS function

   DNS translates website names into IP addresses so computers can find websites.

2. Step 2: Identify DNS poisoning effect

   DNS poisoning gives wrong IP addresses, sending users to fake sites instead of real ones.

3. Final Answer:

   To redirect users to fake websites by giving wrong IP addresses -> Option B

4. Quick Check:

   DNS poisoning = Redirect to fake sites [OK]

Hint: DNS poisoning tricks DNS to give wrong addresses [OK]

Common Mistakes:

• Thinking DNS poisoning speeds up browsing
• Confusing DNS poisoning with encryption
• Believing it blocks websites instead of redirecting

2. Which of the following is a correct way to describe DNS poisoning?

easy

A. It modifies DNS cache with false information

B. It encrypts DNS queries to protect privacy

C. It speeds up DNS resolution by caching

D. It blocks DNS requests from unknown sources

Solution

1. Step 1: Recall DNS poisoning mechanism

   DNS poisoning involves changing DNS cache entries to wrong IP addresses.

2. Step 2: Match description to options

   Only It modifies DNS cache with false information correctly states DNS poisoning modifies DNS cache with false info.

3. Final Answer:

   It modifies DNS cache with false information -> Option A

4. Quick Check:

   DNS poisoning = false DNS cache entries [OK]

Hint: DNS poisoning changes DNS cache to wrong info [OK]

Common Mistakes:

• Confusing poisoning with encryption
• Thinking it speeds up DNS
• Assuming it blocks requests

3. Consider this scenario: A user tries to visit example.com. Due to DNS poisoning, the DNS cache returns the IP 192.0.2.123 instead of the real IP 93.184.216.34. What is the likely result?

medium

A. The user is redirected to a fake website at IP 192.0.2.123

B. The DNS query fails and the website doesn't load

C. The user reaches the real example.com website safely

D. The user's browser automatically blocks the connection

Solution

1. Step 1: Understand DNS poisoning effect on IP

   The DNS cache gives a wrong IP (192.0.2.123) instead of the real one (93.184.216.34).

2. Step 2: Predict user experience

   The user is sent to the wrong IP, likely a fake website pretending to be example.com.

3. Final Answer:

   The user is redirected to a fake website at IP 192.0.2.123 -> Option A

4. Quick Check:

   Wrong IP from DNS = fake site visit [OK]

Hint: Wrong IP from DNS means fake site shown [OK]

Common Mistakes:

• Assuming user reaches real site
• Thinking DNS query fails
• Believing browser blocks automatically

4. A network admin notices users are being redirected to suspicious sites. They suspect DNS poisoning. Which action will help fix this issue?

medium

A. Turn off the internet connection temporarily

B. Disable the firewall to allow all traffic

C. Change all user passwords immediately

D. Clear the DNS cache on affected devices and servers

Solution

1. Step 1: Identify how DNS poisoning affects devices

   DNS poisoning corrupts DNS cache with wrong IP addresses causing redirection.

2. Step 2: Choose corrective action

   Clearing DNS cache removes false entries, restoring correct address resolution.

3. Final Answer:

   Clear the DNS cache on affected devices and servers -> Option D

4. Quick Check:

   Fix DNS poisoning by clearing DNS cache [OK]

Hint: Clear DNS cache to remove poisoned entries [OK]

Common Mistakes:

• Disabling firewall worsens security
• Changing passwords doesn't fix DNS
• Turning off internet is impractical

5. A company wants to protect its users from DNS poisoning attacks. Which combined approach is best to reduce risk?

hard

A. Manually edit hosts files on all user devices

B. Only use public Wi-Fi networks and disable firewalls

C. Use DNSSEC to verify DNS data and configure trusted DNS servers

D. Rely solely on antivirus software for protection

Solution

1. Step 1: Understand DNSSEC and trusted DNS servers

   DNSSEC adds digital signatures to DNS data to verify authenticity. Trusted DNS servers reduce risk of poisoning.

2. Step 2: Evaluate options for protection

   Use DNSSEC to verify DNS data and configure trusted DNS servers combines verification and trusted sources, effectively reducing DNS poisoning risk.

3. Final Answer:

   Use DNSSEC to verify DNS data and configure trusted DNS servers -> Option C

4. Quick Check:

   DNSSEC + trusted DNS = strong DNS poisoning defense [OK]

Hint: Use DNSSEC and trusted servers to stop poisoning [OK]

Common Mistakes:

• Thinking public Wi-Fi is safe
• Manually editing hosts is impractical
• Relying only on antivirus misses DNS attacks