Mass DNS Poisoning...

FYI....

According to the Internet Storm Center they have had several reports of wide-spread DNS poisoning of several sites including google.com, ebay.com and weather.com. We have investigated the sites that are reportingly redirecting users to and they attempt to install and download code and an Active X piece called ABC Search Webinstall. There is also a file called mhh.exe (I have a copy if anyone wants it) that appears to be Spyware that they attempt to download.


DON'T CLICK ON THIS LINK UNLESS YOU WANT THE INSTALLER (mhh.exe) TO BEGIN.
http://www.7sir7.com/abx_search_webi.../download.html

Internet Storm Center Details:
http://isc.sans.org//index.php

--TH13

LOL... FYI everyone, TH13's first link is to a site reportedly affected by this...I haven't followed it, but from the ISC entry:

Quote:

---

Popular domain names such as google.com, ebay.com, and weather.com are being directed to the following servers. Of course when connecting to these servers, "bad things" (tm) will happen, so don't go to them.

http/:www.7sir7.com (217.160.169.87)

---

The mhh.exe file is the installer for this....

http://www.besttoolbars.net/

Don't be a clown and get yourself infected. This means DON'T F#CKING click on it. ;) Hows's that for a disclaimer Zen? LOL.

Anyway, I figured that most here would see the URL and understand what it is. Perhaps I should resort back to the assumption of dumbness rule. Heh.

Quote:

---

Perhaps I should resort back to the assumption of dumbness rule.

---

Perhaps????? C'mon Hoss, you getting senile?

Actually, I was waiting for this. ISC reported a month or so ago a small scale DNS poisoning event. The only reason I could see for it was a "dry run"....

Nasty too that they do it late on a friday.... Just before everyone goes home for the weekend and is out of contact of those who might know about this kind of thing... Their IT chaps.... Nicely planned... All those google etc. hits over the weekend.....

Quote:

---

Perhaps????? C'mon Hoss, you getting senile?

---

I can't remember. LOL.

Whenever I'm operating within my environment, the dumbness flak jacket is always on. I figured this place was still somewhat safe to remove it. I stand corrected. :)

Damm. Google is still find to me! :(

Friday = They gonna miss all the coorporate user! Bad timming!

The good news is it looks like the 7sir7 site has been taken down! DNS lookup still resolves but nothing on port 80 anymore (used WGET to try to grab page and look at it).

:)

Since this is the topic of conversation right now, how exactly does dns poisoning work and why didnt this attack spread further or cause more damage than it did already.....

What other impacts do you see spawning from this? From my slim understanding if this had been used for phishing (I am sure it will happen rather soon) what impacts could this have. does this only affect the name or does it affect the IP as well?

Would like to learn some more on this pharming technique

It is possible to poison DNS by informing a server that a particular asset is at an IP address other than the one it really is located. There are a few ways of doing this, see here for an example.

Once the Server is poisoned then all requests to it will return the wrong IP for the asset that has been poisoned. The magnitude of the effect depends on the "level" of the DNS server. If I poison a server in my private domain then the only clients affected are my own. If I poison my ISP's server then all my ISP's customers are susceptible to the poisoning. If I can poison the root servers the entire internet would be poisoned.

The thread I started here is a beneficial example of DNS Poisoning.

[EDIT]

Fixed my Ooops on the second link.... :o

[/EDIT]