Feeds

Rogue servers point users to impostor sites

'DNS-liars'

The Power of One eBook: Top reasons to choose HP BladeSystem

Researchers have uncovered a large network of rogue servers that threatens end users by silently feeding them counterfeit versions of trusted websites.

It's the internet equivalent of a telephone directory service intentionally giving an incorrect listing when someone asks for the number for Bank of America. Instead of directing a victim to the intended website, about 68,000 servers point to impostor sites, according to the team of researchers from Google and the Georgia Institute of Technology.

They found hundreds of addresses every week that triggered malware that silently changed configuration settings so operating systems, unbeknown to the users, would use the rogue DNS lookups instead of trusted ones. Once that change was made, criminals controlling the servers had the ability to forge the pages when infected users tried to visit virtually any website. The malware effecting such drive-by alterations typically involved a single line of code, making the attack very easy to carry out, said David Dagon, a Georgia Tech researcher who co-authored the paper.

"Instead of having to write an elegant rootkit or a clever buffer overflow or wait for a vulnerability to be found and pounce, the malware writers are saying: 'We'll rewrite people's DNS settings,'" Dagon said. "It's a crime with few witnesses."

The researchers found about 17 million open recursive DNS servers serving the IPv4 address space. Of those, 2.4 per cent were found to give incorrect information. The vast majority - two per cent - were merely providing what is known as "DNS error path correction," which attempts to correct minor typos and isn't intended to deceived users. The remaining 0.4 per cent provided outright false information that was intended to mislead.

Spoofed websites included Bank of America and Whitehouse.gov.

Many of the "DNS liars" impersonated sites in an attempt to harvest user credentials and perform man-in-the-middle attacks. Others simply tried to drive traffic to their sites by redirecting users to parked pages loaded with ads and porn. In some cases, the impostors acted as proxies to the sites being spoofed, but ads or other content would be superimposed on top.

"From the user's perspective, it look like the internet was working just fine - except that a different group of people made money off the ads, and search results could be altered," Dagon said.

The study, titled "Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority," is scheduled to be published in February by the Network and Distributed System Security Symposium in San Diego. Other co-authors include Chris Lee and Wenke Lee, of Georgia Tech, and Niels Provos of Google. ®

This story was updated to correct the number of servers pointing to impostor sites</i.>.

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.