Slashdot Mirror
Brazilian ISPs Hit With Massive DNS Attack
wiredmikey writes "Millions of people in Brazil have potentially been exposed to malware, as a result of a nationwide DNS attack. Additionally, several organizations in Brazil are reporting that network devices are also under attack. After being compromised remotely, scores of routers and modems had their DNS settings altered to redirect traffic. In those cases, when employees of the affected companies tried to open any website, they were asked to execute a malicious Java applet, which would install malware presented as 'Google Defence' software."
You're just another BRIC in the wall.
Sounds like someone is creating a massive botnet for something much bigger or just putting out a warning message. They question is what?
You say things that offend me and I can deal with it. Can you?
Computers may be twice as fast as they were in 1973, but I would kill to go back and live in a time where you had to actually break into my house to steal from me.
someone was not happy with the Conrad Murray verdict!
How many is a brazilian?
Bogtha Bogtha Bogtha
I'm in Sao Paulo, Brazil's largest city, and didn't see any problem. Nor did I see anything reported in local media.
Keep in mind, a DNS attack could be re-routing all your traffic through a server where it's being screened for goodies - best to be paranoid in these instances than assume it's not happening to you.
A feeling of having made the same mistake before: Deja Foobar
Not HTTPS traffic, though, at least not unless they've had access to a CA cert too.
Dilbert RSS feed
Ministry of Information, Deputy Minister, Eugene Helman
NZ Electronics Enthusiasts: Check out my Trade Me Listings
A sweeping bill on cybercrime is due to be voted this week in the Brazilian Congress. The bill caters to banks and other big service providers, but is opposed by most other informed citizens, including the Brazilian Internet managers. The bill has been floored several times in the past few years, but every time was retracted due to fierce opposition. Last time that bill was up for voting there was a wave of hacker attacks to government and politicians' sites a few days before the expected voting date. Those attacks were widely believed to be an attempt by supporters to sway the vote of congressmen in favor of the bill. This attack is more serious but its timing strongly indicates that it has the same motivation.
At Brasilia (not a small city, but smaller) I've seen nothing either. The first time I've heard about the attack is here.
Rethinking email
when you get news about your own country first in an international news site
"life is a joke, and someone is laughing at me"
The ISPs were GVT and Oi (source).
Actually, for me, this is kinda funny - I use Oi, but I only saw about this DNS poisoning here in Slashdot... no changes, no malware warning, nothing.
Nerdy news for your nerdy needs? http://www.soylentnews.org Soylent News is people!
Oi's DNS default poisoning (an unwanted "custom search" instead of 404 error page) is sadly working as usual.
Nerdy news for your nerdy needs? http://www.soylentnews.org Soylent News is people!
Here.
Looks pretty fresh, so that would explain the lack of coverage. Also, the DNS cache poisoning don't seem to be confirmed yet, only the home router cracking. And the guy who went to jail for being paid to change DNS settings is from a small (?) country town, so the reach of this damage might be negligible country-wise.
http://dilbert.com/2010-12-13
A history of DNS Violence
The attacks are being directed at the routers, not the ISPs.
Most Brazilian ISPs use a "borrow my router" (we call it comodato) system, where the client uses ISP's router instead of his own.
The thing is... these routers are configured with a default password and most users don't know/want to change it.
So, no, no peace in MMOs... and as a side note, even being Brazilian, I must agree with you: Brazilian MMO players are fcking annoying, worse if you do know Portuguese.
Nerdy news for your nerdy needs? http://www.soylentnews.org Soylent News is people!
I'm the Brazilian journalist who first reported on this issue.
These attacks are not massive. They are happening in a server each time, and the ISPs use many different servers. As such, the number of affected victims each time is small. However, it is true they are ongoing. ISPs and users need to take action now and protect their DNSs and home routers, respectively, though ISPs are also to blame because they use the same password for the default configuration on every router. Plus, user complaints can be found days apart - but DNS cache poisoning only lasts for a few hours. In other words, there are multiple attacks.
There's info indicating this has been going on and off since at least 2009, but we hadn't heard of it because they were only redirecting banks to identical pages. Now they're trying to use Google, Facebook et al to infect users with trojans, which is far easier to notice.
It's also true a sysadmin was arrested for accepting a R$ 10,000 (about US$ 6,000) monthly bribe to change the DNS configuration in an ISP, probably a small or medium-sized one.
I'm a GVT user (one of the affected ISPs) and I have verified my DNS server went from not using random ports to using random ports. I last checked this about two weeks. So yes - this is happening, and they have taken some action. But the DNS server I use was never poisoned, and many other users have not seen or noticed these attacks.