Which DNS poisoning scenario involves infecting John's machine with a Trojan to change his DNS IP address to the attacker's?

Which DNS poisoning scenario involves infecting John's machine with a Trojan to change his DNS IP address to the attacker's?

• A. Internet DNS poisoning
• B. DNS cache poisoning
• C. Proxy server DNS poisoning
• D. Intranet DNS spoofing attack

Answer: (A)

This scenario tests client-side DNS manipulation through malware. When a Trojan infects John's machine and changes the DNS IP address that the host uses, all DNS lookups from that machine are sent to an attacker-controlled DNS server. The attacker can then respond with false IPs, redirecting John’s traffic to malicious sites or enabling man-in-the-middle activity. This kind of DNS redirection happens because the compromised host itself is directing queries to a rogue DNS server, not because the DNS resolver’s cache was poisoned or because a proxy or internal network service was tampered with. It’s different from DNS cache poisoning, which targets a DNS server’s cached records and can mislead many users who rely on that resolver, rather than altering an individual host’s settings. It’s also distinct from proxy server DNS poisoning, which would involve compromising a proxy to mislead clients behind it, and from intranet spoofing, which typically targets internal network services rather than the end-user host’s DNS configuration.

This scenario tests client-side DNS manipulation through malware. When a Trojan infects John's machine and changes the DNS IP address that the host uses, all DNS lookups from that machine are sent to an attacker-controlled DNS server. The attacker can then respond with false IPs, redirecting John’s traffic to malicious sites or enabling man-in-the-middle activity. This kind of DNS redirection happens because the compromised host itself is directing queries to a rogue DNS server, not because the DNS resolver’s cache was poisoned or because a proxy or internal network service was tampered with.

It’s different from DNS cache poisoning, which targets a DNS server’s cached records and can mislead many users who rely on that resolver, rather than altering an individual host’s settings. It’s also distinct from proxy server DNS poisoning, which would involve compromising a proxy to mislead clients behind it, and from intranet spoofing, which typically targets internal network services rather than the end-user host’s DNS configuration.