DNS Spoofing by The Man In The Middle

This paper is based on a vulnerability in the Windows XP DNS resolver. While other parties have recently published this vulnerability, the vulnerability was independently discovered during research for this paper. Using this vulnerability as an example, this paper demonstrates tools and techniques for discovering and investigating security vulnerabilities. The security vulnerability is then escalated to achieve Man In The Middle (MITM) status. A number of tools and techniques for performing MITM attacks are discussed. Finally, the role of key security controls are discussed as well as techniques an attacker may employ to avoid such controls. Through the discussion of these issues, this paper aims to raise awareness of the importance of security in underlying network protocols such as DNS, TCP and UDP.