How does Tor handle DNS poisoning?

Question

Tor uses an exit node to resolve DNS as per How does Tor route DNS requests?. Isn't it very easy for the exit node to serve a fake website by DNS poisoning? How does Tor handle this threat?

Answer 1

Yes it is, it's also poss. for the exit node to inject html into web pages to either deanonimise or spread malware to the tor user.

Malory won't get away with doing this however because when an exit node initially comes on stream it needs to behave well for a period of time ( =/= a month IIRC) before too much "real" traffic flows via it.

During this period (and after as well) tor monitors traffic flowing in and out of the node and if it detects anything funny it blacklists the node.

Answer 2

It does not. Tor itself JUST OFFERS you an option in using DNS protocol. Install BIND and make it resolve ONLY dot-onion domains via Tor, but do a full lookup from root servers otherwise. like this :

zone "." {
    type hint;
    file "/etc/bind/db.root";
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone "localhost" {
    type master;
    file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
    type master;
    file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
    type master;
    file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
    type master;
    file "/etc/bind/db.255";
};

zone "onion" {
type forward;
forward only;
forwarders {
    127.0.0.2;
};

and - of course - use NO forwarders in your options clause :

dnssec-enable yes;
dnssec-validation yes;
dnssec-must-be-secure onion no;
edns-udp-size 512;
max-udp-size 512;