Malware on Hijacked Subdomains, a New Trend?

The Unmask Parasites blog discusses a technique attackers are using more and more often recently: modifying a compromised site's DNS settings to redirect various subdomains to different IPs that serve up malware, often leaving site administrators none the wiser. Quoting: "It is clear that hackers have figured out that subdomains of legitimate websites are an almost infinite source of free domain names for their attack sites. With access to DNS settings, they can create arbitrary subdomains that point to their own servers. Such subdomains can hardly be noticed by domain owners who rarely check their DNS records after the initial domain configuration. And they cost nothing to hackers. I wonder if using hijacked subdomains of legitimate websites is a new trend in malware distribution or just a temporarily solution that won't be widely adopted by cybercriminals in the long run (like dynamic DNS domains last September)."

Comments

Also done with 404 Error Documents

[Anonymous Coward]

This is also done with 404 Error pages. They change it to redirect to their spam, and then point people at what looks like a legitimate URL. Then they get redirected to the spam and are none the wiser. www.slashdot.org/thisdoesntexist could redirect anywhere.

Re:Also done with 404 Error Documents

[Anonymous Coward]

Agreed 404, 301, 302. Anything that you can drop a .htaccess file into an account.

Ideally, web servers (not just DNS) have a lot of holes, allowing NS access to the user isn't the problem like the TFA implies. Because most automation software doesn't allow for too much sub domain specific flexibility, most times you still need to be in root to redirect at a dns level.

The exception is say parking (godaddy etc) or zoneedit but usually once its hosted it's pretty much in the hands of the admin to delegate externally.

Re:Also done with 404 Error Documents

[DeadPixels]

While I've yet to personally see any subdomain hijacking, I have come across 404 pages that have been turned into drive-by-downloads. Otherwise legitimate sites have all of these extra pages created (www.example.com/search_query_here) that actually just point to malware. While most of them are still fairly easy to pick out because the domain is entirely unrelated to the search term, it's still dangerous and could easily catch many unobservant users.

Administrator negligence?

[davidwr]

"who rarely check their DNS records"

And thereinlies both the problem and the solution.

Re:Administrator negligence?

[oztiks]

I see the best way is to notify admin upon a dns change, any external sites added get sent via email.

(sounds like a job for the guys at http://www.configserver.com/)

unravel the illicit infrastructure

[Anonymous Coward]

Yes, checking the DNS records will help identify the sites that have been modified, however it will also identify the hackers servers IP numbers. With that thread, you can start to unravel the illicit infrastructure, and counteract it.

That explains idle.slashdot.org

[orkysoft]

That explains idle.slashdot.org :-)

As a malware defense professional..

[ma1wrbu5tr]

I can verify that this trend has been building for months. It only seems to be getting worse. We've logged literally hundreds of compromised sites ranging from the very high traffic to the very obscure. This is one case where even vigilant users are undermined by the lack of security awareness of the site admins.