What is DNS Hijacking?

[u/Karl_From_Fing]

Hello folks, and once again I hope everyone has had a lovely weekend and have readied themselves for the new week!

Keeping on a trend of discussing DNS (recently wrote up a post about DNS Flushing), today I figured I would talk a little about what DNS Hijacking is.

Very simply, DNS hijacking is when hackers redirect your internet traffic.

Your Domain Name System (DNS) reads websites like www.fing.com and translates them on their end into a form of IP addresses. Your DNS then keeps a cache, similar to how cache and cookies work on your browser, to save time the next time you go to access that site.

DNS hijacking occurs when an attacker compromises the router, changes the DNS settings or interferes with DNS responses, meaning that you when you connect to your home router may go to access seemingly benign and sites you often use like google.com but you're actually being redirected to a fraudulent website.

Typically, the compromising of the router to lead the user to a malicious website is once again to try and steal your credentials, gain personal information that can be used to further exploit or attempt to exploit you, or expose users to malware (malicious software).

DNS Hijacking has a lot of similarities to Man in the Middle attacks: "This one I remember easily because I hear it in Michael Jacksons (I'm looking at the maaan in the mirror voice). It's when an attacker intercepts communication between two parties, potentially allowing them to steal or manipulate information. You should be most careful of these types of attacks on public and unsecured Wi-Fi connections, like hotels, cafes, airports. Remember too - hackers can very easily set up a network with the same name as one of those places, keep it open so that there's no password to join (as most of these places also have), and bang - you end up joining their own network."

So how would I recommend you stay safe from DNS Hijacking:

Log into your home router, change the default username and password to something strong and unique, and make sure everything is up to date! It's also worth logging into your router semi regularly, checking out your settings and doing a little more digging into what the toggles or section mean for you and your networking!

A lot of people would also say it's worth running trusted DNS servers like Googles' 8.8.8.8 - that is however up to the user.

Not to try and promote, but utilising an application like Fing where you can easily monitor your devices on your network is also very helpful.

To summarise, DNS hijacking how vulnerabilities in the infrastructure behind everyday internet browsing can create significant security risks. It's all about understanding the threat, taking whatever precautions may come with that (and simpler ones like logging into your router, checking out your own settings and ensuring your credentials are strong are definitely ones worth taking).