Slashdot Mirror
DNS Poisoning Hits One of China's Biggest ISPs
Support Code writes "ZDNet's Zero Day blog is reporting that a DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits. The DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer, Adobe Flash Player and Microsoft Snapshot Viewer. In this interview with CNet, Dan Kaminsky confirms that attacks are definitely going on in the field."
I'd like to buy a vowel. A.
I know. They're always nagging me.
Or maybe you mean Noggers?
is property of html, not Apple Inc.
Odd, just a little probe from the NSA?
Whenever attacks target specific countries, I wonder.... Yeah, I guess I'm feeling a little paranoid tonight.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
It's a good thing nobody uses Real Player these days, isn't it!
Since when do I have to input my SSN to post to slashdot?
Modding me -1 troll doesn't make me wrong.
It's busy trying to paint a picture that the whole problem is only with BIND, not with DNS protocol and in particular not with M$ DNS.
The largest prime factor of my UID is 263267.
I doubt it. It's not the NSA style.
... I feel a bit lucky because I never trust my ISP's name servers. I knew this day would come. If possible, I always use the OpenDNS servers. (Disclaimer here: I'm not saying the OpenDNS service is recommended for security. It's just a matter about reputation.)
The Chinese ISPs has been known to use manipulated DNS records as a censorship measure, too. See here: http://slashdot.org/article.pl?sid=07/11/18/1824230
Colorless green Cthulhu waits dreaming furiously.
Someone's decided to make DNS poisoning an Olympic sport. Obviously the only place to do it at the moment is China.
I've got images in my head of a broken toothed Chinese geek running around Beijing with an EEE PC and a Linksys wireless router hooked to a 12V SLA battery, lights a-blinking, instead of the Olympic torch. Thank goodness the Olympics are about to end.
These posts express my own personal views, not those of my employer
Haha, I guess it's kind of become reflex now to capitalize anything coming after an i.
All your base are belong to Wii.
Ahh well, I just chalk it up to payback for all those Chinese hackers out there committing SQL injection attacks and other types of breaches. How's it feel, jackasses?
*whoosh* watch more South Park
It's a big flaw. Someone big was bound to fall foul of it eventually. And to be honest, I can't say that I'm at all surprised. In fact, I'm expecting a lot more.
I bet that there are still hundreds of large companies that are vulnerable worldwide and I bet that translates to hundreds of thousands, if not millions, of affected people. For instance, last time I checked the whole LGfL (London Grid for Learning) was vulnerable - and they provide DNS / Internet connectivity for every school in London (several million users, hundreds if not thousands of schools) with little alternative because they have been mandated as the recommended solution and thus all "interesting" content is in their private network.
If they ARE still compromised (and several days after the release of the information, they were still showing up as vulnerable on all those DNS tests and today I got: Your name server, at ***.***.***.***, appears vulnerable to DNS Cache Poisoning. All requests came from the following source port: 32768), that's virtually every school, staff member and student in London (we're probably talking close on a million people because it includes Greater London Boroughs but I'm not sure of the exact figure) which are in trouble because they use the upstream DNS from LGfL as their basis.
Have we heard anything through official channels? Nope.
Does everybody just trust LGfL to do their job transparently? Yep.
Have they done it? Apparently not.
Have they even heard of it? I don't know, but there have been zero advisories, zero visible configuration changes, that I can see.
Give it a few months, one of the students will download something and poison the whole of London's educational system and THEN maybe someone will bother to look into it.
When I heard about this flaw, the first thing I did was check all upstream servers that either my servers or my own home computers use - my cheap ISP (PlusNet) had apparently fixed the issue before I'd even caught wind of the "there may be a DNS problem" posts on Kaminsky's blog. Every other one just seems to be dragging their feet.
On patch Tuesday MSFT did release a fix for Snapview:
http://support.microsoft.com/kb/955439
In fact Frosty Post AC has a point.
Chinese speakers (at least in Beijing) often use the word é£ä (neige) as a filler word; much in the same way as 'uh' or 'er' are used in the English language.
For anyone with no understanding of the Chinese language will often be confronted by the words 'nigga, nigga' when walking on the streets of Beijing.
"iFrame"? Lower-case i, uppercase next letter? How odd. It's "inline frame", normally all caps ('IFRAME') or all lower-case ('iframe'). "iFrame" makes it sound like some new Apple-branded house support structure with built-in Internet-something.
You like splinters in your crotch? -Jon Caldara
It may be a good idea to check your DNS server to see if it is vulnerable. Dan Kaminsky has a tool that shows vulnerability on his blog.
Whoosh indeed.
Twit.
Check our own ISPs name servers, openDNS's name servers, and we need a third independent name server pool.
Check all three before moving accepting the IP, and if there is any disagreement, just don't go. Also, send an automated warning to all three DNS pools to re-seed their random number generators and clear the contested IP from their cache.
Of course, I'm talking about DNS pools as if they already exist. But they should.
Interactions that need to be secured should also use independent multiple polling before exchanging tokens. Financial institutions, for instance, should keep their own private supernetwork, such that the customer queries their local branch to start login, then queries two other bank-owned check servers, to make sure the branch IP is what the bank says it should be. This would require dedicated browsers, but that's really a given. It's time to quit giving popular browser M, I, or E our credit card numbers to play with. The convenience is not worth it.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
First, thanks for the comments (this one and above). If I had mod points, I would have given you +1 insightful.
After all, how much more insightful is good information from someone directly affected by something we are discussing? Quite a bit more insightful is the answer!
Now to the reason for my reply.
When I was stationed in Germany for the US Army (I live in Oklahoma, USA), I always appreciated corrections to my spoken German language attempts. Most of the time the encounter would turn into a mutual learning session for both of us...the German I talked to would help me with my German skills, and wanted (and received) my help with his English skills. It was a great learning experience for me.
That is the intention of my reply. I have edited your post below for corrections in English grammar. If this has no interest for you, then disregard the rest of the post.
No harm=No Foul!
"This is a very good question. Frankly, I don't know. As I have said, I never trust OpenDNS due to(or you can use 'becuase of' in place of 'due to') security reasons.
*new paragraph=change of subject, or focus on subject*
I use it for my desktop browsing, not for anything worthy enough to be protected. But I know from my own experience that some Chinese ISP's(the apostrophe as applied here seems to be debatable, but was proper usage when I went to school) are seriously incompetent in managing security risks. I have seen some of their mistakes in securing their service so that I wouldn't trust them again.
*new paragraph-see reasons above* ...the lesser of two evils. (pessimistic outlook) ...the better one. (more optimistic) ...the best person currently able to do the job. (most optimistic)"
OTOH I know I have to buy their services to get online and put these rants here,(added comma to 'end' current focus and enable a slight redirect to the sentence) and that sound like a paradox. Maybe it is. Finally we have to trust somebody else. That's how we live (replaced 'make' with 'live') our lives. I just chose to deal with one who has *already* made a (removed 'bad')reputation as...
there are many option here:
1.
2.
3.
I apologize if I have over stepped my bounds here, I only meant to help.
I like to hear from those outside of the USA, so your post has been good for my learning experience.
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
If they were trying to do damage to china, wouldn't they have simply redirected everyone to anti-government propaganda sites instead?
It may be like a reflex now, but at least the "iFrame" name is derived from what it actually is (an Inline Frame) and not just a letter stuck somewhere as part of a marketing or branding gimmick.
Yippe Eye Oh Eye Ay Yippie Eye Ay
Axis of evil gets it in its axis
"Basically, the problem exists in the DNS system, which translates Web addresses into numerical IP addresses and serves as the phone book for the Internet."
I would have expected more from CNet. I guess thats what the internet is now: "The Web".
Obviously some moderator never has never seen this.
Just run your own caching resolver if you don't 100% trust any local ones. I use Unbound and choose not to worry about which external DNS server is "safer", and give myself (overall) faster resolves in the process.
...lead poisoning, was it?
Thank you, thank you, I'll be here all week.
1. Buy gold
... that is: Sell your gold after teh GW upgrades public "terrist" threat level.
2. Poison huge ISP DNS, redirecting to various sites with extreme info on chemical warfare
3. ???
4. Profit
She made the willows dance
TFS was trying to be impartial. They forgot to mention Mozilla though.
Btw - what does the "i" have to do with apple anyhow?
Seven Days with Ubuntu Unity
So we know there is an exploit and it is being redirected to a website...but no one in law enforcement can determine where that IP is located? They're running the scam out in the public, for cripes sake. It's not even like the old shell scam on a card table, where you had to have compatriots looking around the corners for policmen on foot patrols. These scammers have their card tables set up in front of the precinct office.
Yes it is a hole. Yes it needs to be fixed. But would the perps be that difficult to trace down and prosecute?
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
Yeah, and he sure taught you a lesson by modding your explanation of the first post Offtopic.
How dare you point out his ignorance!
I don't care why you're posting AC
Although CNC's DNS server has been poisoned, but the network are so slowly that the virus/malware background downloading failed after half an hour...
I knew that. The whole iLine of products is really annoying to me. Same goes for eMachines, and I have to admit the whole K thing with KDE apps is kind of annoying too. But KDE is still better than GNOME, flamewar go! *ducks*
All your base are belong to Wii.
That's offensive to me!
I demand that you correct your egregious and offensive error, and spell it "limerick" as it should be.
Not to mention that a limerick should officially be 5 lines long.
And you don't have to be Chinese to pee in someone's Coke. I work in a restaurant ;)
Get back, troll.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
the only example on Websense is concerning "gogle.cn". I've just tried a nslookup using CNC DNS (and even with CT DNS) and nothing is wrong... so either, CNC has corrected its DNS (for this specific domain), either...
FluxBox rulz! *ducks lower*
I know tobacco is bad for you, so I smoke weed with crack.