DNS cache poisoning attacks -- are they real?

Sun Mar 27 11:29:33 UTC 2005

On Sat, 26 Mar 2005 17:52:56 -0500 (EST), Sean Donelan <sean at donelan.com> wrote:
> 
> On the other hand, there are a lot of reasons why a DNS operator may
> return different answers to their own users of their resolvers.  Reverse
> proxy caching is very common. Just about all WiFi folks use cripple
> DNS as part of their log on. Or my favorite, quarantining infected
> computers to get the attention of their owners.
> 

I hate that cripple dns stuff - they seem to add transparent proxying
of dns requests to it as well, sometimes.

I've seen cases where my laptop's local resolver (dnscache) suddenly
starts returning weird values like 1.1.1.1, 120.120.120.120 etc for
*.one-of-my-domains.com for some reason.

Thank $DEITY for large ISPs running open resolvers on fat pipes ..
those do come in quite handy in a resolv.conf sometimes, when I run
into this sort of behavior.

--srs