DetailedCAPEC-598
CAPEC-598: DNS Spoofing
Description
An adversary sends a malicious (NXDOMAIN (No such domain) code, or DNS A record) response to a target's route request before a legitimate resolver can. This technique requires an On-path or In-path device that can monitor and respond to the target's DNS requests. This attack differs from BGP Tampering in that it directly responds to requests made by the target instead of polluting the routing the target's infrastructure uses.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- On/In Path Device
Skills required
- LowTo distribute email
Mitigations
- Design: Avoid dependence on DNS
- Design: Include hosts file/IP address in the application
- Implementation: Utilize a .onion domain with Tor support
- Implementation: DNSSEC
- Implementation: DNS-hold-open
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.