Your Router Might Be Lying to You:
The Quiet Rise of DNS Hijacking
Over the last six months, I've been seeing more and more DNS hijack infections on routers, switches, and servers. It's a genuinely clever tactic, and it's worth understanding why: the attacker only needs to briefly gain access and very lightly maintain it. Once they've rerouted your DNS to a server they control, they can quietly sit in the middle of your traffic and analyze your traffic packets, harvest credentials, the works.
This isn't theoretical, and it isn't rare.
My own server and three customer servers have been hit by this class of attack in the last 3 months. I'm writing this to bring some attention to what's going on, explain how these attacks actually work, and (most importantly) show you how to defend your equipment and check whether it's already been hit, without needing to be a network engineer.
