[caption id=“attachment_438” align=“aligncenter” width=“300”]
ESET NOD32 warns of DNS cache poisoning[/caption]
Today I installed ESET NOD32 on my computer, finally no longer running bare. But every time I open my homepage (Google), NOD32 alarms, warning of DNS cache poisoning. But my DNS is Google’s (Google Public DNS) — could such a big company be hacked too? After searching online, actually Google’s DNS isn’t poisoned. So what’s the reason?
In mainland China, for all domain queries over UDP port 53 passing through the Great Firewall, an IDS intrusion detection is performed. Once a domain query request matching a blacklist keyword is found, it immediately disguises itself as the target domain’s resolution server and returns a fake result to the querier. Since ordinary domain queries have no authentication mechanism, and domain queries are usually based on the unreliable connectionless UDP protocol, the querier can only accept the first correctly formatted result and discard subsequent ones.
For netizens who don’t understand the relevant knowledge: because the ISP-provided default query server is polluted by the Great Firewall when querying foreign authoritative servers, its cache is polluted, so by default querying the ISP’s server returns a fake IP; while directly querying foreign DNS servers (e.g., Google Public DNS) may also be polluted by the Great Firewall, so without any protective mechanism you still can’t get the target site’s correct IP.
The Great Firewall hasn’t yet poisoned domain queries under the TCP protocol, so you can now force a real IP by querying via TCP: under Windows, open the command prompt and enter nslookup -vc query-domain foreign-DNS-server-IP (the foreign DNS server must support TCP queries, otherwise no result is returned). After pressing enter, the correct target server IP is returned. But the reality is, the Great Firewall may also use other means to block the real IP, so whether you can truly access may require other circumvention means.
So DNS isn’t really poisoned; this alarm can be ignored, it doesn’t affect normal use. I still opened Google’s homepage.