RE: [Full-Disclosure] Mystery DNS Changes
From: Randal, Phil (prandal_at_herefordshire.gov.uk)
Date: 10/02/03
- Previous message: Feher Tamas: "[Full-Disclosure] Asynchronous, industry-wide virus naming scheme proposed"
- Maybe in reply to: Hansen, Kevin: "[Full-Disclosure] Mystery DNS Changes"
- Next in thread: Paul Tinsley: "Re: [Full-Disclosure] Mystery DNS Changes"
- Reply: Paul Tinsley: "Re: [Full-Disclosure] Mystery DNS Changes"
- Reply: Joe Stewart: "Re: [Full-Disclosure] Mystery DNS Changes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: full-disclosure@lists.netsys.com Date: Thu, 2 Oct 2003 13:31:06 +0100
NAI has this as QHosts-1, and says MS03-032 does NOT protect against it:
http://vil.nai.com/vil/content/v_100719.htm
Cheers,
Phil
---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
> -----Original Message-----
> From: Joe Stewart [mailto:jstewart@lurhq.com]
> Sent: 01 October 2003 21:34
> To: full-disclosure-orig@netsys.com
> Cc: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] Mystery DNS Changes
>
>
> On Wednesday 01 October 2003 03:19 pm, Hansen, Kevin wrote:
> > We have seen multiple instances where DHCP enabled workstations have
> > had their DNS reconfigured to point to two of the three addresses
> > listed below. Can anyone else confirm this? Incidents.org is
> > reporting an increase in port 53 traffic over the last two days. Are
> > we looking at the precursor to the next worm?
> >
> > 216.127.92.38
> > 69.57.146.14
> > 69.57.147.175
>
> The top DNS server change was made by a newer variant of the
> Delude/Startpage trojan. It used to add bogus entries in the
> system32\drivers\etc\hosts file, but lately has begun to change the
> user's DNS registry settings as well. It hijacks the user's
> traffic to
> and from major search engines, redirecting it to a single webserver
> under the control of the trojan author. Any requested search
> pages have
> popup ads for gambling/porn site registration, presumably because the
> trojan author is getting money for registrations via affiliate
> programs.
>
> It is being installed via the MS03-032 IE object tag exploit.
> A scan of
> the system may not turn up any infected files - this trojan does not
> run at startup, and deletes its files after the DNS/hosts
> configuration
> changes are complete.
>
> -Joe
>
> --
> Joe Stewart, GCIH
> Senior Security Researcher
> LURHQ Corporation
> http://www.lurhq.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- Previous message: Feher Tamas: "[Full-Disclosure] Asynchronous, industry-wide virus naming scheme proposed"
- Maybe in reply to: Hansen, Kevin: "[Full-Disclosure] Mystery DNS Changes"
- Next in thread: Paul Tinsley: "Re: [Full-Disclosure] Mystery DNS Changes"
- Reply: Paul Tinsley: "Re: [Full-Disclosure] Mystery DNS Changes"
- Reply: Joe Stewart: "Re: [Full-Disclosure] Mystery DNS Changes"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
