DNS Hijacking
What is DNS Hijacking?
DNS HijackingAn attack that redirects DNS resolution to attacker-controlled answers by modifying client settings, router configurations, resolver responses, or authoritative DNS records.
DNS hijacking covers a family of techniques that subvert the DNS path between a user and the intended service. It can take place on the endpoint (malware changing DNS settings or the hosts file), at the home or enterprise router (compromised CPE), at the recursive resolver (poisoned cache or man-in-the-middle), or at the authoritative DNS provider (compromised account, credential theft, or registrar abuse). Once DNS is hijacked, attackers can intercept email, issue TLS certificates for the hijacked names, run phishing against the legitimate domain, or facilitate other intrusions — as seen in notable campaigns like the DNSpionage and Sea Turtle operations. Mitigations include DNSSEC, registry/registrar locks, CAA records, monitoring DNS records and certificate transparency logs, MFA on DNS provider accounts, and using trusted, validated recursive resolvers (DoH/DoT).
● Examples
- 01
Attackers compromise a registrar account and change a victim's NS records to their own DNS, then issue a TLS certificate to impersonate the site.
- 02
Router malware silently sets all home devices to use a rogue resolver that redirects banking domains to phishing servers.
● Frequently asked questions
What is DNS Hijacking?
An attack that redirects DNS resolution to attacker-controlled answers by modifying client settings, router configurations, resolver responses, or authoritative DNS records. It belongs to the Attacks & Threats category of cybersecurity.
What does DNS Hijacking mean?
An attack that redirects DNS resolution to attacker-controlled answers by modifying client settings, router configurations, resolver responses, or authoritative DNS records.
How do you defend against DNS Hijacking?
Defences for DNS Hijacking typically combine technical controls and operational practices, as detailed in the full definition above.