DNS contamination and DNS hijacking: A guide to differentiation and protection

The DNS (Domain Name System) is the core infrastructure of the Internet and is responsible for converting domain names into IP addresses. However, its importance has also made it a target for attackers, of which DNS contamination and DNS hijacking are two common means of attack. Although both can interfere with DNS resolution, there are significant differences in their principles, implementations, and protection policies. Through comparative analysis, this paper will help users understand the difference between the two, and provide effective protection schemes.

Difference between DNS contamination and DNS hijacking

In principle, DNS pollution forges DNS responses and returns a false IP address to the user. DNS hijacking is the hijacking of DNS requests to force users to a malicious DNS server or to modify the resolution results.

In terms of attack targets, DNS contamination usually targets intermediate networks (such as ISPs, public WiFi) or recursive DNS servers. DNS hijacking directly targets user devices, routers, or local DNS configurations.

In terms of attack scope, DNS contamination can affect all users in a specific area or network. DNS hijacking is typically targeted at a specific user or device.

Technically, DNS pollution takes advantage of DNS protocol vulnerabilities (such as UDP statelessness) to inject fake packets. DNS hijacking tampers with DNS Settings through malware, routing vulnerabilities, or man-in-the-middle attacks.

In typical scenarios, DNS pollution is used for Internet censorship (such as blocking specific websites) and mass phishing attacks. DNS hijacking is an AD injection, phishing attack, traffic monitoring, or targeting attack.

Users perceive that some websites contaminated by DNS cannot be accessed. Replacing the DNS server may restore them. DNS hijack All website resolution exceptions, even if the replacement of the DNS server may still be invalid.

Attack detection method

DNS pollution detection

Compare multiple DNS servers: Use multiple public DNS (such as Google DNS '8.8.8.8', Cloudflare '1.1.1.1') to query the same domain name, if the results are inconsistent, it may be contaminated.

Tool detection: Check the parsing result with the 'nslookup' or 'dig' command, or use an online tool such as DNSCheck.

HTTPS authentication: If a certificate error (such as a domain name mismatch) occurs when you access an HTTPS website, contamination may lead to the wrong IP address.

DNS hijack detection

Check local DNS Settings: See if the DNS configuration of the device or router has been tampered with (such as pointing to an unknown IP).

Traceroute analysis: Trace DNS request path using 'tracert' or 'mtr', abnormal jump may indicate hijacking.

Security software scanning: Use anti-virus software to detect whether the device is infected with hijacking malware (such as DNSChanger).

Protective measure

Fight DNS pollution

Using the encrypted DNS protocol:

DNS over HTTPS (DoH) or DNS over TLS (DoT) : Encrypts DNS queries to prevent man-in-the-middle tampering (e.g. Firefox and Chrome support DoH).

Recommended public DNS services: Cloudflare (' 1.1.1.1 '), Google (' 8.8.8.8 '), Quad9 (' 9.9.9.9 ').

Proxy: Bypass pollution through encrypted tunnels and hide real DNS requests.

Manually configure the HOSTS file: Bind the correct IP address to the key domain name (such as GitHub), but update it periodically.

Defense against DNS hijacking

Hardening router security:

Change the default administrator password and disable the remote management function.

Update router firmware regularly and turn off unnecessary UPnP services.

Enable DNSSEC: Verify the authenticity of DNS responses using digital signatures (supported by the DNS server).

Terminal Protection:

Install anti-virus software and scan for malicious programs regularly.

Avoid connecting to untrusted WiFi, and be wary of phishing emails to induce the installation of malware.

General advice

Multi-factor Authentication (MFA) : Protect critical accounts (e.g. mailboxes, DNS control panels) from post-hijacking attacks.

Periodically check the resolution result: Use the tool to monitor whether the DNS resolution is abnormal.

Educate users: Increase vigilance against phishing attacks and malicious links.

Both DNS pollution and hijacking threaten network security, but pollution relies more on protocol vulnerabilities for large-scale interference, while hijacking realizes targeted attacks by controlling terminals or network devices. The core of protection lies in encrypted communication (DoH/DoT), hardening device security, and increasing security awareness. For enterprise users, a dedicated DNS firewall or threat detection system, such as Cisco Umbrella, can be deployed to further reduce risk. Through the combination of technology and management, the DNS level can be effectively defended against threats.