Feeds

Rogue servers point users to impostor sites

'DNS-liars'

SANS - Survey on application security programs

Researchers have uncovered a large network of rogue servers that threatens end users by silently feeding them counterfeit versions of trusted websites.

It's the internet equivalent of a telephone directory service intentionally giving an incorrect listing when someone asks for the number for Bank of America. Instead of directing a victim to the intended website, about 68,000 servers point to impostor sites, according to the team of researchers from Google and the Georgia Institute of Technology.

They found hundreds of addresses every week that triggered malware that silently changed configuration settings so operating systems, unbeknown to the users, would use the rogue DNS lookups instead of trusted ones. Once that change was made, criminals controlling the servers had the ability to forge the pages when infected users tried to visit virtually any website. The malware effecting such drive-by alterations typically involved a single line of code, making the attack very easy to carry out, said David Dagon, a Georgia Tech researcher who co-authored the paper.

"Instead of having to write an elegant rootkit or a clever buffer overflow or wait for a vulnerability to be found and pounce, the malware writers are saying: 'We'll rewrite people's DNS settings,'" Dagon said. "It's a crime with few witnesses."

The researchers found about 17 million open recursive DNS servers serving the IPv4 address space. Of those, 2.4 per cent were found to give incorrect information. The vast majority - two per cent - were merely providing what is known as "DNS error path correction," which attempts to correct minor typos and isn't intended to deceived users. The remaining 0.4 per cent provided outright false information that was intended to mislead.

Spoofed websites included Bank of America and Whitehouse.gov.

Many of the "DNS liars" impersonated sites in an attempt to harvest user credentials and perform man-in-the-middle attacks. Others simply tried to drive traffic to their sites by redirecting users to parked pages loaded with ads and porn. In some cases, the impostors acted as proxies to the sites being spoofed, but ads or other content would be superimposed on top.

"From the user's perspective, it look like the internet was working just fine - except that a different group of people made money off the ads, and search results could be altered," Dagon said.

The study, titled "Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority," is scheduled to be published in February by the Network and Distributed System Security Symposium in San Diego. Other co-authors include Chris Lee and Wenke Lee, of Georgia Tech, and Niels Provos of Google. ®

This story was updated to correct the number of servers pointing to impostor sites</i.>.

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.