Feeds

Rogue servers point users to impostor sites

'DNS-liars'

Beginner's guide to SSL certificates

Researchers have uncovered a large network of rogue servers that threatens end users by silently feeding them counterfeit versions of trusted websites.

It's the internet equivalent of a telephone directory service intentionally giving an incorrect listing when someone asks for the number for Bank of America. Instead of directing a victim to the intended website, about 68,000 servers point to impostor sites, according to the team of researchers from Google and the Georgia Institute of Technology.

They found hundreds of addresses every week that triggered malware that silently changed configuration settings so operating systems, unbeknown to the users, would use the rogue DNS lookups instead of trusted ones. Once that change was made, criminals controlling the servers had the ability to forge the pages when infected users tried to visit virtually any website. The malware effecting such drive-by alterations typically involved a single line of code, making the attack very easy to carry out, said David Dagon, a Georgia Tech researcher who co-authored the paper.

"Instead of having to write an elegant rootkit or a clever buffer overflow or wait for a vulnerability to be found and pounce, the malware writers are saying: 'We'll rewrite people's DNS settings,'" Dagon said. "It's a crime with few witnesses."

The researchers found about 17 million open recursive DNS servers serving the IPv4 address space. Of those, 2.4 per cent were found to give incorrect information. The vast majority - two per cent - were merely providing what is known as "DNS error path correction," which attempts to correct minor typos and isn't intended to deceived users. The remaining 0.4 per cent provided outright false information that was intended to mislead.

Spoofed websites included Bank of America and Whitehouse.gov.

Many of the "DNS liars" impersonated sites in an attempt to harvest user credentials and perform man-in-the-middle attacks. Others simply tried to drive traffic to their sites by redirecting users to parked pages loaded with ads and porn. In some cases, the impostors acted as proxies to the sites being spoofed, but ads or other content would be superimposed on top.

"From the user's perspective, it look like the internet was working just fine - except that a different group of people made money off the ads, and search results could be altered," Dagon said.

The study, titled "Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority," is scheduled to be published in February by the Network and Distributed System Security Symposium in San Diego. Other co-authors include Chris Lee and Wenke Lee, of Georgia Tech, and Niels Provos of Google. ®

This story was updated to correct the number of servers pointing to impostor sites</i.>.

Intelligent flash storage arrays

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.