How Hackers Use DNS Server to Hack (and How to Protect Yourself)

How Hackers Use DNS Server to Hack

Hackers are scary. They can do so much damage to your computer. They have the ability to plant viruses on your computer, steal your information, take control of your system and make it look like you are downloading child pornography, stealing info from government agencies, or doing any number of other illegal activities that can land you in jail or cost you huge fines.

One of the biggest ways they can get to you is by using your DNS server. In this guide, we highlight how do hackers use your DNS server to hack you and what can you do to protect yourself from hackers.

What is a DNS Server and What Is Its Purpose?

First, let’s examine what a DNS server is and what purpose they serve. A DNS server is a computer server that has a database of public IP addresses and their associated hostnames. 

The server’s purpose is to resolve, or translate, those names to IP addresses as requested. DNS servers run special software and communicate with each other using special protocols. Other names you may see that mean the same thing as the DNS server include name server or domain name system server.

It’s a lot easier for people to remember a domain name like SoftwareKeep.com than it is a string of numbers (an IP address), but for computers, it’s easier to use numbers because they don’t work well with names. All we do is type in the domain name we want and the DNS servers got to work figuring out where we want to go by using IP addresses. This is what a DNS server does.

How Do Hackers Use DNS Servers to Hack?

Hackers create malware programs that can change your DNS server settings. For example, if your computer uses Google's DNS servers and you want to go to your bank’s website, you type in the URL of your bank and expect to be taken to your bank’s official website. 

If you’ve downloaded malware that changes your DNS server settings, your system will no longer use Google's DNS servers. It will reference the hacker’s servers, which will emulate your bank’s website. The website will look exactly like your bank’s website, but instead of logging you into your bank account, the website steals your username and password once you’ve typed it in. This gives hackers all of the information they need to then access your bank account. 

Pretty scary, huh? Your DNS server info can be changed behind your back, without you knowing. Once you’ve visited your “fake” bank website and entered your information without gaining entry into your account, you might very well just assume the website isn’t working correctly and try again later. 

The problem here is that it will be too late by then. The hackers have already gotten into your bank account and can clean you out before you know there has been a problem.

These malware attacks can do other things as well. Once they have changed your DNS server settings, they can take you to websites that are full of porn, have tons of malicious ads on them, or to a fake site that tricks you into believing your computer has been infected with a virus. 

You may have seen this before, and if you have, your DNS server settings have been altered. This scam has been responsible for getting many people to pay for something they don’t need because they fear their computer will be destroyed by a virus or locked down. NEVER believe you have a virus because a website pops up telling you that your computer is infected. The only issue you are having is that your DNS server settings have been changed.

How to Protect Yourself from DNS Server Settings Attacks

Now that we’ve made you nervous, let’s talk about how you can protect yourself from these attacks and save yourself some money and headaches. Let’s face it, someone getting access to your bank account can cost you a lifetime of savings.

It could be devastating. At the very least, it is an invasion of your privacy. How can you protect yourself from being a victim of malware that hijacks your DNS server?

There are ways you can protect yourself from being a victim of DNS server settings being changed. 

First and foremost, install a trusted antivirus program on your computer that will watch over your system for any changes. There are many antivirus software programs capable of doing this. SoftwareKeep carries all of the biggest names in antivirus software. 

Most antiviruses are capable of tracking and stopping changes to your DNS settings. Antivirus software is the absolute first line of defense to protect yourself from falling victim to hackers.

This may seem like a simple move, but it can help you protect yourself as well. Pay attention to the websites you visit. Be aware of how they look and be on the lookout for any changes in the appearance of the website. 

If you go to a website that doesn’t quite look the way you think it should, maybe there is a problem and you should exercise caution. Maybe the colors or graphics are slightly different than what you expect. You might notice a big difference in the menus. Websites do change the way they look from time to time, but if you are used to a specific look and the website you’re visiting is almost the same but not quite, you could be on a hacker’s server. 

Also, if you get an "invalid certificate" message in your browser, you could very well be signed in to a fake website. The very best thing you can do if any of this happens is to leave the website immediately and try to contact the company directly. Also, if you don’t have antivirus software at this point, install trusted software and run it to ensure nothing bad is happening. These fake websites are a huge threat to your security.

Not all DNS server redirection is bad. Some companies use it to prevent employees from visiting porn or gambling sites at work. The redirection occurs when a “forbidden” URL is typed. Instead of accessing the “forbidden” website, the employee is directed to a blocked page or some other page. This is called OpenDNS.

Should You Ever Change DNS Settings?

A primary and secondary DNS server is configured on your router or computer when you connect to your internet service provider. There are two DNS servers in so that if one fails, the other kicks in to resolve hostnames you enter.

While you may never find yourself needing to change your DNS server settings, there are times you might want to change them. You should know what you are doing before you attempt to change DNS server settings.

One reason to change DNS servers is that some have faster access times than others. This is usually determined by how close you are to those servers. If your ISP's DNS servers are closer to you than Google's, you may find domain names are resolved quicker using the default servers from your ISP than with Google’s servers. 

If you are experiencing connection problems, you may have an error with the DNS server. If the DNS server isn't able to find the correct IP address associated with the hostname you enter, the website can't be located and loaded. Changing your DNS settings can help.

How to Find DNS Server Settings Information

The “nslookup” command is what you use to query your DNS server on Windows PCs. Open your “command prompt” and type a URL such as SoftwareKeep.com proceeded with nslookup. It will look like this: nslookup SoftwareKeep.com. A list of IP addresses will be returned to you. That list represents all of the IP addresses associated with the URL you have typed.

There are 13 important DNS root servers on the Internet used to store a complete database of domain names and associated public IP addresses. These top-tier DNS servers are named A through M for the first 13 letters of the alphabet. Ten of the servers are in the U.S., one is in London, one is in Stockholm, and one is in Japan. You can find a complete list of the DNS root servers here.

Let SoftwareKeep Help You Get Protected

SoftwareKeep has your back. We understand that hackers are out there and we want to make sure you have the antivirus software you need to stay safe online. Antivirus software is essential, not only for protection from malware that redirects you to fake websites but from all of the nasty viruses that permeate the Internet. 

Trend Micro, AVG, Kaspersky, and Symantec are just some of the antivirus software products we carry. Our prices are the lowest you will find anywhere on the biggest names in antivirus software.