Feeds

Rogue servers point users to impostor sites

'DNS-liars'

3 Big data security analytics techniques

Researchers have uncovered a large network of rogue servers that threatens end users by silently feeding them counterfeit versions of trusted websites.

It's the internet equivalent of a telephone directory service intentionally giving an incorrect listing when someone asks for the number for Bank of America. Instead of directing a victim to the intended website, about 68,000 servers point to impostor sites, according to the team of researchers from Google and the Georgia Institute of Technology.

They found hundreds of addresses every week that triggered malware that silently changed configuration settings so operating systems, unbeknown to the users, would use the rogue DNS lookups instead of trusted ones. Once that change was made, criminals controlling the servers had the ability to forge the pages when infected users tried to visit virtually any website. The malware effecting such drive-by alterations typically involved a single line of code, making the attack very easy to carry out, said David Dagon, a Georgia Tech researcher who co-authored the paper.

"Instead of having to write an elegant rootkit or a clever buffer overflow or wait for a vulnerability to be found and pounce, the malware writers are saying: 'We'll rewrite people's DNS settings,'" Dagon said. "It's a crime with few witnesses."

The researchers found about 17 million open recursive DNS servers serving the IPv4 address space. Of those, 2.4 per cent were found to give incorrect information. The vast majority - two per cent - were merely providing what is known as "DNS error path correction," which attempts to correct minor typos and isn't intended to deceived users. The remaining 0.4 per cent provided outright false information that was intended to mislead.

Spoofed websites included Bank of America and Whitehouse.gov.

Many of the "DNS liars" impersonated sites in an attempt to harvest user credentials and perform man-in-the-middle attacks. Others simply tried to drive traffic to their sites by redirecting users to parked pages loaded with ads and porn. In some cases, the impostors acted as proxies to the sites being spoofed, but ads or other content would be superimposed on top.

"From the user's perspective, it look like the internet was working just fine - except that a different group of people made money off the ads, and search results could be altered," Dagon said.

The study, titled "Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority," is scheduled to be published in February by the Network and Distributed System Security Symposium in San Diego. Other co-authors include Chris Lee and Wenke Lee, of Georgia Tech, and Niels Provos of Google. ®

This story was updated to correct the number of servers pointing to impostor sites</i.>.

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.