DNS hacked/hijacked by the "Delude.B" trojan

From: Jonathan de Boyne Pollard (J.deBoynePollard_at_Tesco.NET)
Date: 10/03/03

  • Next message: ry_at_DundasValley: "Re: Peace of mind to anyone who wishes to know if there are any installations happening behind your back" 
    Date: Fri, 03 Oct 2003 11:46:03 +0100

    c> I'm having a strange problem [...]
    c> [...] I looked my tcp/ip config and my dns servers were
    c> set to something they shouldn't be! Usually it is on
    c> automatically obtain. [...] The DNS addresses were:
    c> 69.57.146.14 [and] 69.57.147.175
    c> I did ipconfig /displaydns and wow, I had tons of entries!
    c> It filled a .txt file with 66kb worth of entries [...]
    c> Now the weird part, they are all search engines! [...]
    c> My dns cache won't get rid of those addresses. [...]
    c> The first time I rebooted it Windows complained about command.com [...]

    You've been hit by the "Delude.B" trojan. This trojan uses a bug
    in Microsoft's Internet Explorer (which, according to CERT Incident
    Note IN-2003-04, has not been properly fixed) that allows web page
    authors to write web pages that will cause Internet Explorer to
    automatically download and execute whatever programs the web page
    author desires. So at some point you've displayed a web page that
    caused this trojan to be downloaded and run.

    The trojan changes the proxy DNS servers that your DNS Client is
    configured to use, to the addresses of two machines assigned to
    Everyone's Internet which were discovered to have been compromised
    and which have since been taken out of service. The intent of the
    attacker was clearly to run a proxy DNS service providing
    name->address mappings of his/her choosing, in order to impersonate
    services without your being any the wiser.

    The trojan also populates your "HOSTS" file with a large number
    of entries, mapping the names of several widely used web sites to
    an IP address whose content HTTP service the attacker intended to
    control. The intent of the attacker was clearly, again, to
    impersonate services without your being any the wiser. The fact that
    these are search engines is not weird, therefore.

    The reason that flushing the DNS Client cache does not cause these
    mappings to go away is that Microsoft's DNS Client automatically
    initially populates its cache from the content of the "HOSTS" file.
    You must edit the "HOSTS" file itself for these mappings to go away.

    The trojan does not stick around. It performs its task and then
    deletes itself from the machine. Since running executables in Win32
    cannot delete themselves, it does this by spawning a command
    interpreter, passing it a command script containing commands to
    delete both the executable and the script. My educated guess is
    that the NTVDM process running COMMAND was caused by a witless novice
    coding error on the part of the author of the trojan: hard-wiring
    "COMMAND" as the name of the command interpreter that it invokes
    instead of looking at the value of the %COMSPEC% environment
    variable to find what command interpreter to use, as one should.

    <URL:http://www.cert.org./incident_notes/IN-2003-04.html>
    <URL:http://f-secure.com./v-descs/delude.shtml>

  • Next message: ry_at_DundasValley: "Re: Peace of mind to anyone who wishes to know if there are any installations happening behind your back"

    Relevant Pages

    • DNS hacked/hijacked by the "Delude.B" trojan
      ... The DNS addresses were: ... You've been hit by the "Delude.B" trojan. ... name->address mappings of his/her choosing, ... passing it a command script containing commands to ...
      (microsoft.public.win2000.security)
    • RE: Broken reverse DNS lookup which I cant fix
      ... Change the DNS settings to Standard Primary Zone. ... Change the zone to accept nonsecure and secure dynamic updates. ... On each domain controller, at a command prompt, type the following ... Open Active Directory Users and Computers, click View, Advanced ...
      (microsoft.public.windows.server.sbs)
    • Re: unable to load ONE web site - unknown zone
      ... If you like try setting prompts and see if you at least get a prompt. ... Let's check the DNS because it is the next easiest thing to do ... Open a command window (e.g. Run... ... enter just nslookup ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • RE: Dhcp errors, warnings listed in Event Viewer
      ... There click on your LAN connection and Select Properties, ... Automatically and the DNS. ... CMD.exe click and on the Prompt command type: ... I notice that the alerts show up only then; ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: DNS hacked/hijacked by the "Delude.B" trojan
      ... The DNS addresses were: ... This trojan uses a bug> in Microsoft's Internet Explorer that allows web page> authors to write web pages that will cause Internet Explorer to ... The intent of the> attacker was clearly to run a proxy DNS service providing> name->address mappings of his/her choosing, in order to impersonate> services without your being any the wiser. ... Since running executables in Win32> cannot delete themselves, it does this by spawning a command> interpreter, passing it a command script containing commands to> delete both the executable and the script. ...
      (microsoft.public.win2000.security)