Slashdot Mirror
Brazilian ISPs Hit With Massive DNS Attack
wiredmikey writes "Millions of people in Brazil have potentially been exposed to malware, as a result of a nationwide DNS attack. Additionally, several organizations in Brazil are reporting that network devices are also under attack. After being compromised remotely, scores of routers and modems had their DNS settings altered to redirect traffic. In those cases, when employees of the affected companies tried to open any website, they were asked to execute a malicious Java applet, which would install malware presented as 'Google Defence' software."
Sounds kind of sticky.
To offset political mods, replace Flamebait with Insightful.
You're just another BRIC in the wall.
Sounds like someone is creating a massive botnet for something much bigger or just putting out a warning message. They question is what?
You say things that offend me and I can deal with it. Can you?
Computers may be twice as fast as they were in 1973, but I would kill to go back and live in a time where you had to actually break into my house to steal from me.
someone was not happy with the Conrad Murray verdict!
I'm in Sao Paulo, Brazil's largest city, and didn't see any problem. Nor did I see anything reported in local media.
How many is a brazilian?
Bogtha Bogtha Bogtha
Massive Attack Gives ISPs a Brazilian
with 70. Brazil must be a distraction from the Greek implosion.
Here is the Internet Traffic Report.
Have a day!
Yours In Dallas,
Kilgore Trout.
Ron "Mucho Wacko" Paul For President !!!
Ministry of Information, Deputy Minister, Eugene Helman
NZ Electronics Enthusiasts: Check out my Trade Me Listings
A sweeping bill on cybercrime is due to be voted this week in the Brazilian Congress. The bill caters to banks and other big service providers, but is opposed by most other informed citizens, including the Brazilian Internet managers. The bill has been floored several times in the past few years, but every time was retracted due to fierce opposition. Last time that bill was up for voting there was a wave of hacker attacks to government and politicians' sites a few days before the expected voting date. Those attacks were widely believed to be an attempt by supporters to sway the vote of congressmen in favor of the bill. This attack is more serious but its timing strongly indicates that it has the same motivation.
I bet it was Chael Sonnen. Seriously, I didn't know they had computers there.
And on that day, millions of huehuehuehuehuehues were silenced.
Hi. That's very weird news. I live in Sao Paulo, Brazil, and I did not see nor heard anything about that. So i doubt it's "millions" of brazilians. Which ISP exactly got infected? And where are the references for the "several Brazilian ISPs"?
BR?
when you get news about your own country first in an international news site
"life is a joke, and someone is laughing at me"
Oi's DNS default poisoning (an unwanted "custom search" instead of 404 error page) is sadly working as usual.
Nerdy news for your nerdy needs? http://www.soylentnews.org Soylent News is people!
Maybe online gamers can have a day or two in peace if the Brazilian ISP's have to go offline to fix this. Brazilians have a terrible (deserved)reputation of being griefers and trolls.
A history of DNS Violence
Jeez, I take care of three networks here in Brazil, two small and one that is rather large (as in >10.000 nodes, in > 200 sites).
It is the damn zombie apocalypse down here, man. Only they don't want brains, they feed on packets and credentials. Instead of the stench of death, the air is thick with spam.
Yes, we are pretty sure this is the same !@#$! narcs for hire that are helping the groups that want that congress law passed, only now they decided to finance a _real_ large-scale international criminal operation instead of duping a bunch of idiot kids into DDoSing some Brazilian targets. Last time, they duped Lulzsec into accepting a traitor and used the fools to further their goals. This time, we've had three separate bank systems forced offline "for unspecified reasons" in the last month, and now a massive DNS attack.
In Brazil, nothing like this happens by coincidence. Our local criminals are in the business of making money, and not in the business of getting the fed police involved (it usually results in real jail time and deaths) and getting more draconian laws passed. Right now, the only criminals that are not happy with the status-quo are the suits from the RIAA and MPAA-like organizations pushing for what people here calls the "AI-5 digital" (AI-5 was the government act that created our version of the ghestapo during the military dictatorship in the 60's, 70's and 80's).
I'm the Brazilian journalist who first reported on this issue.
These attacks are not massive. They are happening in a server each time, and the ISPs use many different servers. As such, the number of affected victims each time is small. However, it is true they are ongoing. ISPs and users need to take action now and protect their DNSs and home routers, respectively, though ISPs are also to blame because they use the same password for the default configuration on every router. Plus, user complaints can be found days apart - but DNS cache poisoning only lasts for a few hours. In other words, there are multiple attacks.
There's info indicating this has been going on and off since at least 2009, but we hadn't heard of it because they were only redirecting banks to identical pages. Now they're trying to use Google, Facebook et al to infect users with trojans, which is far easier to notice.
It's also true a sysadmin was arrested for accepting a R$ 10,000 (about US$ 6,000) monthly bribe to change the DNS configuration in an ISP, probably a small or medium-sized one.
I'm a GVT user (one of the affected ISPs) and I have verified my DNS server went from not using random ports to using random ports. I last checked this about two weeks. So yes - this is happening, and they have taken some action. But the DNS server I use was never poisoned, and many other users have not seen or noticed these attacks.
the news is light on pratical details