In which DNS poisoning scenario is a Trojan on a host used to change that host's DNS resolver settings to point to the attacker's server?

In which DNS poisoning scenario is a Trojan on a host used to change that host's DNS resolver settings to point to the attacker's server?

• A. DNS cache poisoning
• B. DNS spoofing
• C. Proxy server DNS poisoning
• D. Internet DNS poisoning

Answer: (D)

The key idea here is that DNS poisoning can happen by compromising a victim’s own machine to alter how it resolves names. When a Trojan on a host changes that machine’s DNS resolver settings to point to an attacker-controlled DNS server, every domain lookup from that host goes to the attacker's server. That rogue resolver then decides which IP address to return, often steering the user to malicious sites or intercepting traffic. This is a form of poison that operates at the client level, effectively poisoning the DNS path that the user’s machine relies on when communicating over the Internet. This best fits the broader notion of Internet DNS poisoning because it describes corrupting how a specific host resolves names by directing its queries to an attacker’s server, rather than tampering with a recursive resolver’s cache (DNS cache poisoning) or merely forging responses (DNS spoofing). It’s also not about a proxy server’s DNS being poisoned, since the changes originate on the host itself.

The key idea here is that DNS poisoning can happen by compromising a victim’s own machine to alter how it resolves names. When a Trojan on a host changes that machine’s DNS resolver settings to point to an attacker-controlled DNS server, every domain lookup from that host goes to the attacker's server. That rogue resolver then decides which IP address to return, often steering the user to malicious sites or intercepting traffic. This is a form of poison that operates at the client level, effectively poisoning the DNS path that the user’s machine relies on when communicating over the Internet.

This best fits the broader notion of Internet DNS poisoning because it describes corrupting how a specific host resolves names by directing its queries to an attacker’s server, rather than tampering with a recursive resolver’s cache (DNS cache poisoning) or merely forging responses (DNS spoofing). It’s also not about a proxy server’s DNS being poisoned, since the changes originate on the host itself.