Slashdot Mirror
Paul Vixie: 100,000 DSL Modems May Lose Their DNS On July 9
Dante_J writes "Up to 100,000 DSL modems may lose access to DNS come July the 9th, due to scripted web interface changes made to them by DNSChanger. This and other disturbing details were raised by respected Internet elder Paul Vixie during a presentation at the AusCERT 2012 conference."
What DNS issues?
Why don't they just start redirecting web users to a warning page explaining the situation to them at some point before the cut off date?
Assuming that these were modems provided by their ISP, then the ISP has responsibility here. They can easily watch for packets going to the fake DNS servers, and then warn the customers by email, letter, and even phone. They should have done this back when the issue first arose, with steps to correct the problem included in a letter with the monthly bill.
Presumably they know what IP was being checked for DNS. All an ISP has to do is spoof that IP internally with a manual route to their own DNS server. That should save a few truck rolls.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
I'm sure some companies will want to buy those servers so they can put ads on those error pages that pop when you enter a nonexistent domain.
Surely there are options on the table. However, the fact that Vixie concluded that "these will be very difficult to re-program" when a group of Estonian hackers managed to do it through a completely illegitimate virus, completely remotely, is troubling. Something about the process must have been irreversible otherwise a simple "undo" page distributed through DNS forwarding could have taken care of it as soon as the servers were under FBI control.
What is more interesting is that they dont make any stabs at guessing how many of the victims are on what providers (just referring to them as "DSL".) Why not name names? You have the IPs of the vics. If AT&T saw 150,000 customers about to go dark, and so did Verizon and so did CenturyLink, i suspect the problem would be confronted more directly than a single powerpoint at some conference in *Australia*...
(A) Not every jurisdiction enforces very much in the way of vehicle safety and emissions inspection laws, so your "We don't" is unsupportably broad. I could certainly agree with a more factually accurate phrase like "We shouldn't", but that's not very good reinforcement for your absolutist position. Sorry.
(B) Speaking of inspections, are you advocating for public safety inspections of online computing assets? It sure sounds like it. And if so, by whom and using what criteria, and very specifically how do you keep those criteria from devolving into some kind of corporatist rights grab a la pernicious DRM?
And (C), if you're not advocating public net-worthiness inspections of computers, your analogy breaks down, since the virus-infected computers in question have already had their road-safety incident. So, your phrase, more accurately stated, is "We don't let people drive cars on public roads that have already risked the safety of other drivers", in which case the response is "of course not, they're already wrecked."
Welcome to the Panopticon. Used to be a prison, now it's your home.
"We don't let people drive cars on public roads that risk the safety of the other drivers."
Is that really true? I'm having difficulty believing that.
I think a better car analogy is:
"We imprison people for drunk driving, because it is a felony, unless they are Senators. Why not imprison people who spew viruses and malware too? (unless it's the NSA or RIAA)"
“Common sense is not so common.” — Voltaire
I'm not sure I understand the problem...
Did this malware hit the DSL modem web-config page from the Internet to change it's DNS settings?
Or is this Windows malware that, once infecting a PC on the LAN, used that PC to hit the web-config page?
One would assume the web-server in the DSL modem doesn't answer on the public interface or IP, but clearly they fucked up the security to start with so that's not an assumption I want to make.
If this malware hit it from the Internet, then it would be trivial for the ISP to do the same exact thing to put the settings back.
The ISP even has legit and legal access to their customer premise equipment, so it wouldn't be illegal or labeled as "hacking" in that case.
Even if the modem web-config only answers to the LAN IP, and it was an infected Windows box that automatically reconfigured the router... wouldn't there be a password of some sort?
And why doesn't the ISPs maintain a "maintenance" subnet where they CAN access the DSL modem?
All the ISP needs to do is add a route to their core routers for the old DNS server IPs that will be going down soon, and redirect those packets to their internal DNS servers.
Failing That, the ISP can log any customers that access the hijacked DNS IPs, build up a list, and mail out a letter to them postal style. If they don't read their ISPs snail-mail, then they deserve whatever outage they get.
Believe me, once service goes down, they WILL be calling the ISP. I can understand wanting to lessen the massive amounts of calls they are expecting on the 9th, but in order to lessen that flood they will need to do Something. Anything. Anything except the nothing they seem to be doing.
Just setup a web site with all the info they need, which can be accessed with an IP alone. Give that to them on the phone. Include both the address and IP in the snail mail letter.
Hell, at that point the ISP can include a link that when clicked will connect to the internal IP of the router and submit new DNS settings in the GET request. A small amount of javascript will handle if a POST is needed.
There is clearly no password on the web interface to deal with, or they wouldn't have this problem from the malware in the first place, so this should be trivial to fix semi-automated, and likely totally automated with a bit more work.
This sounds more like laziness and ineptness rather than any technical reason for fixing the problem.
There are some people who will call tech support whether they get a warning or not. Usually the wrong support, and usually to unload a half hour of angry rants that do absolutely nothing to fix the problem. If there's any reading involved beyond about the 2nd-3rd grade level, they'll ignore warning dialogs and just call and complain. This is a constant in the tech support universe.
(And I still have to laugh when people tell me their internet isn't working but they can send and receive email..)
DNS? pshaw!
If you just listened to APK and put everything in your HOSTS file, you wouldn't have to worry about any of this folderoll!
I'm still in favor of the big red button with a clearly worded warning on it that says it will render the computer unusable and/or void the warranty if pressed. The people who read instructions and warnings and in general have some clue what they're doing will leave it alone and get years of service out of the computer; the ones who just poke and click at things totally at random when things don't do what they expect get what they deserve...
He still missed correcting "Internet elder" to "elder of the Internet".
Some modems implement this , TR-069 (remote config) protocol. At least some of the clueless should have this active, I'm surprised it's not used more widely by ISP's Of course anyone with half a brain will have it disabled,( do you want your ISP to control your router? ) and if you have it disabled at least you know your modem/router HAS a config page but still, it's for exactly this reason it's there.
In 2009, there were 32 million DSL modems in the United States. http://www.internetworldstats.com/am/us.htm
Even if there has been no growth in DSL usage, 100,000 modems represents 0.3% of all DSL users.
BUT, this 100,000 number is world wide modems that have been compromised. That makes the actual percentage of modems affected so small that it hardly seems worth the time to calculate it.
Turn the "bad" DNS off, and most tech support lines will not even notice the increase in support calls.
So the malware guys found a bunch of unpatched DSL modems with a vulnerability that allowed the resolver to be reconfigured remotely, and pointed it towards the "bad" DNS servers.
So why not just go to the "bad" DNS servers, which they now control, find out the IP addresses of the compromised modems, and use the same vulnerability to reconfigure the resolver to point back to "good" DNS servers?
Tired of FB/Google censorship? Visit UNCENSORED!
peer-to-queer downloads
what an embarrassing Freudian slip.
you're running the buttorrent client I take it?
I was wondering the same thing. Then I remembered a few years back when my provider, replacing a modem that had taken a power surge, tried to pawn off one of those "NAT router/modems" on me.
If they're being used as such, for internal DHCP, that might be a problem, I guess...
What's with all the "combined router/modem" bashing in this thread? Is it really that big a problem for you, to not be /forced/ to use a separate router and/or switch? Most router/modems I have seen can also be set to a direct or bridge mode to disable the router and go back to being a dumb modem.
Even more so, what's with all the people who seem to be surprised at the concept? I can't remember the last time I even saw a consumer-level DSL modem that was not also a router - maybe ten years? This is not new or unusual tech.
Surely there are options on the table. However, the fact that Vixie concluded that "these will be very difficult to re-program" when a group of Estonian hackers managed to do it through a completely illegitimate virus, completely remotely, is troubling. Something about the process must have been irreversible otherwise a simple "undo" page distributed through DNS forwarding could have taken care of it as soon as the servers were under FBI control.
I suspect the "difficulty" is more legal than technical. The Estonians don't care if they brick an occasional device, and they don't try to get the users' legal consent. And people and governments in other countries might not be happy to trust the FBI to reprogram their router/modem.