The DNS was not meant to address security issues and for this reason, it does have security issues. One of the more common security threats to a domain server is cache poisoning. Cache poisoning can lessen the profits of a page and make the website lose visitors. In worst-case scenarios, cache poisoning is used to spread viruses and Trojans to a website’s would-be visitors. This is caused by sending the visitor to an infected website. Until the DNS servers become more secure, DNS spoofing will continue to exist.

Cache Poisoning

What does it mean when a cache is poisoned? It is called cache poisoning when a cache has incorrect information that it shares with other servers. What it means is that a DNS server can sometimes get the IP address of a domain name wrong. This can be through error or by somebody purposely providing false information to the server. The problem occurs because a DNS server was not designed with security in mind. The DNS will blindly follow the information that is given to it, sometimes, without even checking the IP address with the domain name.

DNS Spoofing

When incorrect information is purposely given to a DNS server, this is called DNS spoofing and it is considered malicious behavior. The incorrect IP address is filed and served to anyone who makes the request for spoofed domain name, which is why it is called cache poisoning. When a person is involved in DNS spoofing, the person will take advantage of the DNS security weakness and replace the correct IP address with an IP address of their choosing.

A cache spoofer can use a rogue server of his or her own to provide false information to the system. Usually, visitors are sent to a website that is under the control of the DNS spoofer. The spoofer will match fake addresses and files with the IP address. The spoofer may also insert a virus into the DNS server. The DNS server would then infect the computers of unsuspecting users when a user visits the incorrect IP address.

Denial of Service

There are two main reasons why a spoof attacker will spoof. The first reason is denial of service (DoS). A spoofer sends a negative response to a DNS name that means that the user making the request will be denied service or the user will be sent to another DNS that does not have the service for which the user is making a request. A spoofer can also cause a server to crash from supplying incorrect information to a server.

Cache poisoning is a serious threat to the ability of a website to conduct business. Sometimes, cache poisoning has been found to be from the efforts of an unhappy worker. In order to combat this problem, there is now a secure DNS, DNSSEC, which uses a digital certificate to check the legitimacy of IP addresses and other data. Until DNS servers check each domain name, request and resolver for legitimacy, this type of security problem will continue to exist.