GTCL (Gas Transmission Company Limited) Assistant Engineer (CSE) Exam: 2022 (BUET)প্রশ্ন ও সমাধান

Answer: DNS poisoning (DNS cache poisoning) is an attack in which a hacker injects a forged DNS record into a resolver's cache, causing it to return a fraudulent IP address for a legitimate domain name.

How it works:

1. The attacker floods a resolver with forged DNS responses, racing to guess the transaction ID/source port before the real authoritative server's genuine reply arrives.
2. If the spoofed response is accepted first, the resolver caches the fake domain-to-IP mapping for its configured TTL.
3. Every user whose device queries that (now-poisoned) resolver is silently redirected to the attacker's IP instead of the real site — even though the correct domain name was typed.

sequenceDiagram
    participant C as Client
    participant R as DNS Resolver
    participant H as Attacker
    participant S as Real Server
    C->>R: Query - www.bank.com?
    H-->>R: Forged reply - www.bank.com = Attacker IP (races the real reply)
    R->>R: Caches the forged (poisoned) record
    R-->>C: Returns Attacker's IP
    C->>H: Connects, believing it is www.bank.com
    Note over S: Real server never receives the client's traffic

Impact: the fake site is usually a visual clone, enabling credential theft, malware delivery, or man-in-the-middle interception.

Defences: DNSSEC (cryptographically signs DNS records), randomised query IDs/source ports, and resolvers validating that responses come from the exact server queried.

Exam takeaway: DNS poisoning = injecting a fake IP into a resolver's cache so a legitimate domain resolves to an attacker-controlled server; DNSSEC is the standard countermeasure.