How is DNS hijacking accomplished? Three methods attackers use to tamper with DNS records.

　　DNS translates domain names into IP addresses; you can think of it as the internet's phone book. The essence of DNS hijacking is that attackers tamper with this "phone book," causing you to dial a scammer instead of the person you're trying to reach. The difference is: the URL you enter hasn't changed, and the browser address bar displays correctly, but the actual server you're accessing has changed. Even more insidiously, the page might look exactly the same as the real one.

　　While attackers use various methods to tamper with DNS resolution records, they can ultimately be categorized into three paths: hijacking your local device, hijacking your router, and hijacking the DNS server itself. Let's explain each one in detail.

　　The first method: Local device hijacking

　　This is the most direct and easiest to understand method. The attacker's target is the device you are currently using.

　　Core method: Modifying the hosts file

　　Every operating system has a local file called hosts. Its priority is higher than the DNS server—meaning if the hosts file contains a rule like "www.example.com corresponds to 1.2.3.4", the system will use that result directly without consulting the DNS server.

　　Attackers, after infiltrating your computer through malware, phishing emails, or bundled software, will insert "redirect rules" into the hosts file. For example, they might redirect a bank's website domain to a spoofed IP address. Every time you enter the URL, you'll be redirected to the phishing website without your knowledge.

　　The hosts file path is:

　　Windows: C:\Windows\System32\drivers\etc\hosts

　　macOS/Linux: /etc/hosts

　　If you suspect you've been compromised, open this file and check for any suspicious entries. Normally, except for the entry "127.0.0.1 localhost", all other entries should have a reason.

　　Another approach: tampering with system DNS settings

　　Besides the hosts file, attackers may also directly modify your computer's DNS server address. In Windows network settings, change the DNS from "Obtain DNS server address automatically" to an address specified by the attacker. This way, all your domain name resolution requests will first pass through the attacker's DNS server, giving you whatever result they want.

　　Typical characteristic: Abnormal access on a single device, but other devices on the same network function normally. If your computer cannot access a certain website, but your mobile phone connected to the same Wi-Fi can, it's very likely that your local device has been compromised.

　　Second type: Router DNS hijacking

　　While local hijacking only affects one device, router hijacking affects everything—all devices connected to the same Wi-Fi network, including phones, computers, and tablets, are affected.

　　How is it done?

　　Attackers typically gain access to your router in two ways:

　　First, by using default or weak passwords. Many users never change their router's management password; combinations like admin/admin or admin/123456 are still standard on many routers. After scanning your router, an attacker can easily gain access by trying the default password.

　　Second, by exploiting known vulnerabilities in the router firmware. Many older routers have unpatched security vulnerabilities in their management interfaces. Attackers can directly modify configurations through specific HTTP requests, sometimes without even a password.

　　Once inside the router's admin panel, the attacker can change the router's DNS server address to one they control. When the router assigns network parameters via DHCP, it pushes this malicious DNS address to all connected devices. Your phone, computer, and smart TV will all be forced to query the attacker's DNS server.

　　Typical characteristics: All devices on the entire home or office network experience simultaneous access problems. If you find that your phone, computer, and tablet cannot access the same legitimate website, or are redirected to strange pages, the problem is most likely with the router.

　　The third type: DNS server attack – directly disabling the entire DNS system

　　While the first two methods attack the "end-user side," this one attacks the DNS resolution infrastructure itself. It has the widest impact and the highest technical barrier.

　　Method A: DNS cache poisoning

　　This is the most classic DNS server attack method. Attackers don't directly control the DNS server; instead, they "poison" the DNS server's cache by injecting forged DNS records, causing the server to remember an incorrect IP address.

　　The technical principle is as follows: DNS queries use the UDP protocol, which in its early design lacked encryption and authentication mechanisms. When a DNS server receives a response packet, it uses a 16-bit transaction ID to match which query the response corresponds to.

　　What the attacker does is: while a user is querying the DNS server, the attacker sends a large number of forged response packets to the DNS server, brute-forcing the 16-bit transaction ID. Once guessed correctly, the DNS server accepts the forged response and stores it in its cache. Afterward, all users querying the same domain name from this DNS server will receive the incorrect IP address.

　　This vulnerability still exists today. Although randomization techniques increase the difficulty of guessing, unencrypted DNS queries are still easily eavesdropped on and tampered with by man-in-the-middle attacks.

　　Method B: Intrusion into the Authoritative DNS Server

　　If the attacker's target is not the recursive server, but the domain's authoritative DNS server—the server that stores the final DNS records for your domain name—then... Once breached, attackers can directly modify the domain's A or CNAME records, redirecting traffic to any destination they desire.

　　The massive access outage experienced by Baidu in 2010 was caused by attackers compromising Baidu's account with its US domain registrar, modifying the authoritative DNS server's pointers, resulting in users worldwide being unable to access Baidu for several hours.

　　Method C: Man-in-the-Middle Attack (MITM) – Interception in Transmission

　　Attackers "set up a checkpoint" on the link between the user's device and the DNS server, intercepting DNS query requests and preemptively returning a forged DNS response.

　　Why can they get ahead? Legitimate DNS responses must travel through the authoritative server before returning, while forged responses can be sent back quickly in the middle of the link. If the attacker is faster than the real server, the user will receive the forged response first.

　　Typical Scenarios: Public Wi-Fi hotspots, compromised ISP networks, and insecure LAN environments. In these networks, attackers can deploy forged DNS servers, intercepting all resolution requests and returning malicious IPs.

　　Attack Chain: How the Three Methods Work Together

　　These three attack methods do not exist in isolation. A typical attack chain might look like this:

　　The attacker first hijacks the company network's DNS settings (Method Two), redirecting all employees' internet access to a DNS server controlled by the attacker. This malicious DNS server resolves most domains normally, but returns cached poisoning (Method Three) phishing website IPs for specific bank domains. When employees visit the bank's website, they see a phishing page, and their information is stolen after entering their account passwords.

　　To cover their tracks, the attacker might also hijack local devices (Method One) to add another attack on the computers of select high-value employees, ensuring that even if the router settings are discovered, these target devices remain under control.

　　How to Determine if You've Been Hit?

　　Check the Hosts File: Open the hosts file and check for any unfamiliar domain mapping records.

　　Check Device DNS Settings: Check the DNS server addresses in the system network settings. If you see unfamiliar IPs, it means they have been modified.

　　Check your router's DNS settings: Log in to your router's admin panel and check the DNS address in the WAN port or DHCP settings to confirm it's familiar (e.g., 114.114.114.114, 8.8.8.8).

　　Compare access from multiple devices: If a website opens on a mobile phone but not on a computer, the problem lies on the device side; if all devices cannot access the website or experience redirection issues, the problem lies on the network side or the DNS server side.

　　SSL certificate errors: When accessing sensitive websites, if the browser displays an invalid or untrusted certificate message, you may have been redirected to a phishing site.

　　The core logic of DNS hijacking is simple: trick your "phone book" and lead you into a trap. Attackers don't necessarily need to compromise your website or steal your password; they just need to mislead you.

　　The three methods are progressively more advanced: local hijacking affects a single device, router hijacking affects the entire network, and DNS server attacks affect a large number of users. Understanding these methods is not about fear, but about knowing where to start in prevention—changing the default password of your router, checking your hosts file for any strangers, and glancing at the padlock icon next to the address bar before performing any sensitive operations. These are all low-cost, high-return daily habits.