Slashdot Mirror
Paul Vixie: 100,000 DSL Modems May Lose Their DNS On July 9
Dante_J writes "Up to 100,000 DSL modems may lose access to DNS come July the 9th, due to scripted web interface changes made to them by DNSChanger. This and other disturbing details were raised by respected Internet elder Paul Vixie during a presentation at the AusCERT 2012 conference."
What DNS issues?
Why don't they just start redirecting web users to a warning page explaining the situation to them at some point before the cut off date?
The FBI has control of the DNS servers. Why can't they just resolve every address to point to a webserver instructing people how to fix their DNS settings?
Looking for a job?
Want your resume written professionally?
DON'T USE TUNAREZ!!!
Assuming that these were modems provided by their ISP, then the ISP has responsibility here. They can easily watch for packets going to the fake DNS servers, and then warn the customers by email, letter, and even phone. They should have done this back when the issue first arose, with steps to correct the problem included in a letter with the monthly bill.
Presumably they know what IP was being checked for DNS. All an ISP has to do is spoof that IP internally with a manual route to their own DNS server. That should save a few truck rolls.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
I'm sure some companies will want to buy those servers so they can put ads on those error pages that pop when you enter a nonexistent domain.
Why warn them at all? If they can't be bothered to keep their equipment in good working condition, which means free of malware, the rest of the internet doesn't need them polluting the waters.
We don't let people drive cars on public roads that risk the safety of the other drivers. Why should we put up with an infected virus-spewing computer?
John
I have had nothing but good service from TWC here in Austin, I understand that in some other markets though that they do indeed suck.
My experience with DSL though has been nothing but shitty. YMMV.
Don't know something? Look it up. Still don't know? Then ask.
"We don't let people drive cars on public roads that risk the safety of the other drivers."
Is that really true? I'm having difficulty believing that.
I think a better car analogy is:
"We imprison people for drunk driving, because it is a felony, unless they are Senators. Why not imprison people who spew viruses and malware too? (unless it's the NSA or RIAA)"
“Common sense is not so common.” — Voltaire
I'm not sure I understand the problem...
Did this malware hit the DSL modem web-config page from the Internet to change it's DNS settings?
Or is this Windows malware that, once infecting a PC on the LAN, used that PC to hit the web-config page?
One would assume the web-server in the DSL modem doesn't answer on the public interface or IP, but clearly they fucked up the security to start with so that's not an assumption I want to make.
If this malware hit it from the Internet, then it would be trivial for the ISP to do the same exact thing to put the settings back.
The ISP even has legit and legal access to their customer premise equipment, so it wouldn't be illegal or labeled as "hacking" in that case.
Even if the modem web-config only answers to the LAN IP, and it was an infected Windows box that automatically reconfigured the router... wouldn't there be a password of some sort?
And why doesn't the ISPs maintain a "maintenance" subnet where they CAN access the DSL modem?
All the ISP needs to do is add a route to their core routers for the old DNS server IPs that will be going down soon, and redirect those packets to their internal DNS servers.
Failing That, the ISP can log any customers that access the hijacked DNS IPs, build up a list, and mail out a letter to them postal style. If they don't read their ISPs snail-mail, then they deserve whatever outage they get.
Believe me, once service goes down, they WILL be calling the ISP. I can understand wanting to lessen the massive amounts of calls they are expecting on the 9th, but in order to lessen that flood they will need to do Something. Anything. Anything except the nothing they seem to be doing.
Just setup a web site with all the info they need, which can be accessed with an IP alone. Give that to them on the phone. Include both the address and IP in the snail mail letter.
Hell, at that point the ISP can include a link that when clicked will connect to the internal IP of the router and submit new DNS settings in the GET request. A small amount of javascript will handle if a POST is needed.
There is clearly no password on the web interface to deal with, or they wouldn't have this problem from the malware in the first place, so this should be trivial to fix semi-automated, and likely totally automated with a bit more work.
This sounds more like laziness and ineptness rather than any technical reason for fixing the problem.
DNS? pshaw!
If you just listened to APK and put everything in your HOSTS file, you wouldn't have to worry about any of this folderoll!
I have had nothing but good service from TWC here in Austin, I understand that in some other markets though that they do indeed suck.
My experience with DSL though has been nothing but shitty. YMMV.
DSL Used to be awesome, esp if you could get a 3rd party provider like Speakeasy. Once AT&T was able to avoid giving access to Speakeasy though, it went downhill quickly and has sucked ever since.
TWC sucks massively here in Arlington,Tx. One of the issues is that they route me through Houston, even if i'm connecting to my work systems a few miles away. But then if I try to access a system in Houston, it sends the traffic down to Houston, back to Dallas, then back down to Houston.
And those are my options. Nearly non-functional DSL limited to 6Mbps [but only actually getting 3Mbps most of the time] or horribly inefficient TWC at 30Mbps but that routes me all over the place and drops packets like nobody's business...
Nothing to see here
Many of these DSL customers will buy a new computer in July. And then will probably switch to cable. I think a tiny minority will realize that their DSL modem is cooked and be able to convince their ISP of the same.
He still missed correcting "Internet elder" to "elder of the Internet".
Some modems implement this , TR-069 (remote config) protocol. At least some of the clueless should have this active, I'm surprised it's not used more widely by ISP's Of course anyone with half a brain will have it disabled,( do you want your ISP to control your router? ) and if you have it disabled at least you know your modem/router HAS a config page but still, it's for exactly this reason it's there.
In 2009, there were 32 million DSL modems in the United States. http://www.internetworldstats.com/am/us.htm
Even if there has been no growth in DSL usage, 100,000 modems represents 0.3% of all DSL users.
BUT, this 100,000 number is world wide modems that have been compromised. That makes the actual percentage of modems affected so small that it hardly seems worth the time to calculate it.
Turn the "bad" DNS off, and most tech support lines will not even notice the increase in support calls.
So the malware guys found a bunch of unpatched DSL modems with a vulnerability that allowed the resolver to be reconfigured remotely, and pointed it towards the "bad" DNS servers.
So why not just go to the "bad" DNS servers, which they now control, find out the IP addresses of the compromised modems, and use the same vulnerability to reconfigure the resolver to point back to "good" DNS servers?
Tired of FB/Google censorship? Visit UNCENSORED!
Because they probably act as a router and caching DNS server, too?
And my first thought was Got Proof?
Don't know something? Look it up. Still don't know? Then ask.
peer-to-queer downloads
what an embarrassing Freudian slip.
you're running the buttorrent client I take it?
If DNS changer redirects gov.au then I could be looking at the look-alike DNS changer checker telling me all is fine? They should have listed this as an IP address.
My computer says it is 165.191.2.65 Is that what yours says?
Some drink at the fountain of knowledge. Others just gargle.
Surely the modem is a layer1/layer2 device, and not anything higher? Why does the modem itself need DNS settings?
I want to delete my account but Slashdot doesn't allow it.
That eye-glasses shadow in his picture sure makes him look evil. But my wife says that she's seen him look like that without his glasses. I remember at LISA '96 I asked him a question (ok, it was kinda stupid) and he responded, "RTMF. Next!" But then again at a later LISA he, even though he was sick as a dog, took the time in the hallway to give my wife a detailed answer to a question about round-robin with CNAME records
I totally respect the man.
-- I have a private email server in my basement.
Cool - ARIN and other RIRs should just reposses those IPs, and if these DNS modems want to regain their DNS, they should be made to do it via IPv6, not IPv4.
I do not have mod point, so I can't mod you up again
But anyway, I do appreciate what you are doing here
Muchas Gracias, Señor Edward Snowden !
Sounds like someone needs to buck up the escalation chain until someone who knows anything gets on the phone.
That's a definite problem. Network admins hate those kinds of shenanigans, provided they know about them. That last part is the hard part - how to get it to their attention.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
TFA says "The affected customer modems make up about a third of the 350,000 to 400,000 internet users believed to still have the DNSChanger malware on either their modems or Windows computers."
I don't get it. Is this malware Windows specific? How does it infect modems? Is a Linux user affected by this? What if you have Linux cabled to your router and a Windows machine using wifi? How can one determine if they have an infected modem?
Free Martian Whores!