DNS POISONING + CENSORSHIP LAB DUSTIN VANDENBERG, VIPUL AGARWAL, LIANG ZHAO 1

OUR LAB 1. Background Information 2. Reconnaissance 3. Control System 4. Redirection 5. Exploit 6. Context 2

1. BACKGROUND INFORMATION Domain Name System (DNS) DNS Attacks Wireshark Socket Programming Proxies 3 Combination of explanation and sources DNS Architecture The Hosts File and What it can do for you Decrypting SSL traffic with Wireshark and ways to prevent it Traffic Analysis with Wireshark Using Wireshark to Decode SSL/TLS Packets Investigation of DHCP Packets using Wireshark Wireshark Lab: DNS Wireshark User’s Guide Man in the Middle

1. BACKGROUND INFORMATION (CONT.) DOMAIN NAME SYSTEM (DNS) 4 Internet: Authoritive DNS Servers Resolver: gethostbyname( Server: is Caching DNS Server dns.microsoft.com dns.hacker.com Client

1. BACKGROUND INFORMATION (CONT.) DNS ATTACKS DNS Cache Poisoning Rogue DNS Server DNS Amplification Attack 5 This is what we use in the lab These are just given as examples for further study

1. BACKGROUND INFORMATION (CONT.) WIRESHARK Packet Capture Packet Analysis 6 Source:

1. BACKGROUND INFORMATION (CONT.) SOCKET PROGRAMMING Sockets -> Network Connections in Java 7 Out In Out In Connection Sockets

8 1. BACKGROUND INFORMATION (CONT.) PROXIES (MAN-IN-THE-MIDDLE) Proxy (Evil?) Client Microsoft HTML We want control of this power

2. RECONNAISSANCE What is our target website? How is the target accessing that website? Ports, Protocols, Proxies, Network Setup How can we become a man-in-the-middle? 9 Source:

3. CONTROL SYSTEM What happens once we are a man-in-the-middle? We have to create that proxy functionality 10 DEMO!

4. REDIRECTION We now must take control of the traffic Examples: Hosts file redirection, configure router 11 DEMO! (Another)

5. EXPLOIT Have fun with this power! 12 DEMO! (Yet Another) …surprise, surprise

6. CONTEXT Reflection on what this actually accomplished Limitations of our methods Ways to improve How this is used in the real world 13

THANK YOU! QUESTIONS/COMMENTS 14