Feeds

Rogue servers point users to impostor sites

'DNS-liars'

Top 5 reasons to deploy VMware with Tegile

Researchers have uncovered a large network of rogue servers that threatens end users by silently feeding them counterfeit versions of trusted websites.

It's the internet equivalent of a telephone directory service intentionally giving an incorrect listing when someone asks for the number for Bank of America. Instead of directing a victim to the intended website, about 68,000 servers point to impostor sites, according to the team of researchers from Google and the Georgia Institute of Technology.

They found hundreds of addresses every week that triggered malware that silently changed configuration settings so operating systems, unbeknown to the users, would use the rogue DNS lookups instead of trusted ones. Once that change was made, criminals controlling the servers had the ability to forge the pages when infected users tried to visit virtually any website. The malware effecting such drive-by alterations typically involved a single line of code, making the attack very easy to carry out, said David Dagon, a Georgia Tech researcher who co-authored the paper.

"Instead of having to write an elegant rootkit or a clever buffer overflow or wait for a vulnerability to be found and pounce, the malware writers are saying: 'We'll rewrite people's DNS settings,'" Dagon said. "It's a crime with few witnesses."

The researchers found about 17 million open recursive DNS servers serving the IPv4 address space. Of those, 2.4 per cent were found to give incorrect information. The vast majority - two per cent - were merely providing what is known as "DNS error path correction," which attempts to correct minor typos and isn't intended to deceived users. The remaining 0.4 per cent provided outright false information that was intended to mislead.

Spoofed websites included Bank of America and Whitehouse.gov.

Many of the "DNS liars" impersonated sites in an attempt to harvest user credentials and perform man-in-the-middle attacks. Others simply tried to drive traffic to their sites by redirecting users to parked pages loaded with ads and porn. In some cases, the impostors acted as proxies to the sites being spoofed, but ads or other content would be superimposed on top.

"From the user's perspective, it look like the internet was working just fine - except that a different group of people made money off the ads, and search results could be altered," Dagon said.

The study, titled "Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority," is scheduled to be published in February by the Network and Distributed System Security Symposium in San Diego. Other co-authors include Chris Lee and Wenke Lee, of Georgia Tech, and Niels Provos of Google. ®

This story was updated to correct the number of servers pointing to impostor sites</i.>.

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.