Full Disclosure mailing list archives
RE: Mystery DNS Changes
From: "David Vincent" <david.vincent () mightyoaks com>
Date: Wed, 1 Oct 2003 15:01:25 -0700
it was said.... ------------------ We have seen multiple instances where DHCP enabled workstations have had their DNS reconfigured to point to two of the three addresses listed below. Can anyone else confirm this? Incidents.org is reporting an increase in port 53 traffic over the last two days. Are we looking at the precursor to the next worm? 216.127.92.38 69.57.146.14 69.57.147.175 Are these entries coming in the DHCP packets or are they being set *after* DHCP is complete? Are compromised systems acting like DHCP servers stuffing their own DNS entries into specially crafted replies? Can you post traffic dumps? ------------------ check here: http://isc.sans.org/diary.html?date=2003-10-01 ------------------ DNS abnormalitities As initially posted to the SANS intrustions list, some sites observe an increase in abnormal DNS queries. For the original post, see http://cert.uni-stuttgart.de/archive/intrusions/2003/10/msg00003.html A likely related issue has been reported to NT Bugtraq: http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0310&L=ntbugtraq&D=0 &F=P&P=1048 Here, a user reported that "Various Windows 2000 professional workstations are changing the DNS servers they are configured to use". The new DNS server, 216.127.92.38 and 69.51.146.14, is hosted by 'Everyone's Internet Inc.', (ev1.com). This user did report suspicous changes to the registry: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Inter faces\windows] "r0x"="your s0x" "NameServer"="69.57.146.14" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Inter faces\{45F95E82-B443-428B-9EB7-4C65CDCD9006}] "T2"=dword:3e057410 "LeaseTerminatesTime"=dword:3e067130 "LeaseObtainedTime"=dword:3dfe8830 "T1"=dword:3e027cb0 "NameServer"="69.57.146.14" for more details, see this NT Bugtraq post: http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0310&L=ntbugtraq&D=0 &F=P&P=1879 ------ If you would like to share any related logs, please send them to isc_AT_sans.org ------------------ ...and someone else on NTBugTraq said... ------------------ The top DNS server change was made by a newer variant of the Delude/Startpage trojan. It used to add bogus entries in the system32\drivers\etc\hosts file, but lately has begun to change the user's DNS registry settings as well. It hijacks the user's traffic to and from major search engines, redirecting it to a single webserver under the control of the trojan author. Any requested search pages have popup ads for gambling/porn site registration, presumably because the trojan author is getting money for registrations via affiliate programs. It is being installed via the MS03-032 IE object tag exploit. A scan of the system may not turn up any infected files - this trojan does not run at startup, and deletes its files after the DNS/hosts configuration changes are complete. ------------------ -d _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Mystery DNS Changes Hansen, Kevin (Oct 01)
- Re: Mystery DNS Changes Gary Flynn (Oct 01)
- Re: Mystery DNS Changes Brian Eckman (Oct 01)
- Re: Mystery DNS Changes Russell Fulton (Oct 01)
- Re: Mystery DNS Changes Mary Landesman (Oct 01)
- Message not available
- Re: Mystery DNS Changes Mike Tancsa (Oct 01)
- Re: Mystery DNS Changes Gary Flynn (Oct 01)
- Re: Mystery DNS Changes Danny Pansters (Oct 01)
- Re: Mystery DNS Changes Joe Stewart (Oct 02)
- <Possible follow-ups>
- RE: Mystery DNS Changes Brown, James (Jim) (Oct 01)
- RE: Mystery DNS Changes Schmehl, Paul L (Oct 01)
- RE: Mystery DNS Changes David Vincent (Oct 01)
- RE: Mystery DNS Changes tom_gordon (Oct 01)
- RE: Mystery DNS Changes Harris, Michael C. (Oct 01)
- Re: Mystery DNS Changes Paul Tinsley (Oct 01)
- Re: [Snort-sigs] Re: Mystery DNS Changes Paul Tinsley (Oct 02)
- Re: [Snort-sigs] Re: Mystery DNS Changes Paul Schmehl (Oct 03)
- Re: [Snort-sigs] Re: Mystery DNS Changes Paul Tinsley (Oct 03)
- Re: [Snort-sigs] Re: Mystery DNS Changes Paul Schmehl (Oct 03)
- Re: Mystery DNS Changes Paul Tinsley (Oct 01)
- RE: Mystery DNS Changes Kurt (Oct 02)