5.2.2. DNS and Rogue Device Attacks

DNS Attacks:

• DNS poisoning: Inject false records into cache
• DNS spoofing: Respond with false answers
• DNS tunneling: Encodes data in the subdomain labels of DNS queries to an attacker-controlled domain, creating a covert channel for exfiltration or command-and-control. Indicator: a burst of queries for many unique, random-looking subdomains of one domain.

Defense: DNSSEC, DoH, DoT

Rogue Devices:

• Rogue DHCP: Unauthorized server assigns bad configurations
• Rogue AP: Unauthorized wireless access point

Defense: DHCP snooping, wireless intrusion detection

Evil Twin: Malicious AP mimicking legitimate network SSID. Victims connect to attacker's network.

Other Wireless Attacks:

• Deauthentication attack: Spoofed management frames kick clients off the AP, often to push them onto an evil twin or capture a reconnect handshake. Protected Management Frames (802.11w) block it.
• WPS brute force: Guesses the 8-digit WPS setup PIN—validated in two halves, so only about 11,000 guesses—to recover the WPA/WPA2 passphrase. Disable WPS.
• KRACK (Key Reinstallation Attack): Replays WPA2 four-way handshake messages so the client reinstalls a key already in use, resetting its nonce and letting the attacker decrypt traffic. It doesn't reveal the Wi-Fi password; the fix is patching clients and APs.

On-path Attack (Man-in-the-Middle): Attacker intercepts communication between parties, potentially reading or modifying traffic.