dashing.sujay

Moving
Staff member
I'm facing this sometimes-

BiHyu.png



I scanned my computer and 192.168.1.1 lappi with fully updated ESET, and no viruses are there. What could it be? Though there are more lappis connected through wifi, its saying attack is from 192.168.1.1, so I didn't check others. But I don't think there would be any viruses on any of the laptops.
 

MyGeekTips

script-kiddie geek
Man it's a very very serious threat. I'll explain you what it is:

A Domain Name System (DNS) poisoning attack, also called DNS spoofing, is when an attacker is able to redirect a victim to different website than the address that he types into his browser. For example, a user types Google into their browser, but instead of being directed to Google’s servers he is instead is sent to a fraudulent site that may look like Google’s site but is in actuality it is controlled by the attacker. The attacker is able to do this by changing the Internet Protocol (IP) address that usually points to Google to the fake IP address of the attacker.

The Domain Name System is needed so that networked machines can communicate with each other. Machines use a unique IP address to identify one another much the same way a street address is used to locate a business or home. However, people like words such Google, Yahoo, or YouTube instead of a difficult to remember IP address, like 67.13.142.130, which is easier for a machine to understand. Domain name servers are used to convert names to their corresponding IP address and vice versa.

An attack can happen by modifying the host tables that are stored on local computers. The host table is list of domains and IP addresses that are used to find the correct IP address when a user enters a domain site name. If the so-called host table name system does not have the correct IP address stored locally then it contacts an external DNS for the correct IP address. If an attacker is able to compromise the entries within the host table then they can direct websites names to any IP address they wish.

Conclusion: Some person with local access to your network is doing this. So, Beware & find out who it is. :)
 
OP
dashing.sujay

dashing.sujay

Moving
Staff member
I know all this, thanks for reply though :). And till date I have not been able to spot a single redirection. Plus my wifi is WPA-PSK2 secured and I keep checking regularly what systems are connected to it.
 
OP
dashing.sujay

dashing.sujay

Moving
Staff member
Problem is the attack doesn't occurs regularly. Like it has not appeared since 3-4 days. It appears randomly in once or twice.
 
Top Bottom