Abusing TCP/IP Name Resolution in Windows to Carry Out Phishing Attacks

I was playing with name resolution in Windows and I found that it sends broadcast requests over the network for the hostnames not resolved by DNS or WINS services. This is characteristic behaviour of Windows and *nix boxes do not send any such broadcast requests. As these are the broadcast requests, these can easily be abused to carry out phishing attacks. I wrote a small paper on this. You can access it [here](/content/sites/all/assets/group/nss_uploads/2007/03/microsoft-word-abusing-nbns1.pdf "Abusing NBNS"/index.html).

Updates

Here is a good article from Microsoft which discusses this process in detail. Here are a few drawbacks of this attack:

1. This attack will only work for domain names that are less than 16 characters.
2. Routers typically do not forward broadcasts, so only NetBIOS name on the local network can be resolved and the attacker thus has to be on the same local network.
3. The victim has to enable NetBIOS Over TCP/IP to send out broadcast request.