Tutorial II: Create script in python translated several months ago an article I commented something about DNSChanger, and now, says a new feature.
few days ago, both houses as different antivirus SANS warned more than curious behavior in the old family of malware known DNSChanger. This has evolved substantially: It started with local change of the configuration of DNS servers in the system (to drive the victim to the servers that the attacker wants). Has reached the point of installing a kind of server And DHCP and infect an entire internal network. DNS servers that install malware on the network are often known as UkrTeleGroup. Family DNSChanger
DNSChanger An interesting feature is that it is one of the families who have attacked more than Macs in addition to Windows. Among many other ways to encounter them, are often found in servers, eMule, camouflaged under the guise of other programs.
is a family known for about three years. They are characterized by modifying the DNS servers to the victim that they infect. Thus, the IP-domain association is under the control of the attacker, so that the victim will go to the attacker IP DNS server configured in particular. Normally, people rely on the ISP DNS, but if you set any other resolution is really at the mercy of his manager, whatever his intentions.
DNSChanger began modifying the local system settings, so changing ISP's DNS servers to the victim by other controlled by the attacker. Then, the malware has evolved towards changing the ADSL router from the victim. Sought the "gateway" system, which usually correspond to the router, and make requests or exploit vulnerabilities in routers known to modify these values. So the user was affected by change but in a much more complex to detect. In addition, would be affected the rest of the machines that take these values \u200b\u200bfrom the router itself.
Stepping beyond
The latest development involves the installation observed the victim of a small DHCP server. This is the protocol used in local networks so that when a system connects to the network, the server will recognize it and automatically provide the necessary values \u200b\u200bto communicate (direction, ip, gateway ...). Typically also provides the values \u200b\u200bof the DNS servers you set the administrator or the router. The malware installed
a driver that allows you to manipulate low-level Ethernet traffic, or make any packages. With this technique simulates a DHCP server. When it detects DHCP legitimate questions of a system on the network, the malware responds with its own DNS settings so that the computer you just plug into the local network would be configured as the attacker wants, and not as the administrator scheduled. The attacker relies on luck, as the legitimate DHCP server on the network, if any, would also respond.
Who comes first wins. " They get infections and "clean", it is difficult to know who originated the traffic if it is not stored and analyzed. In addition, this method can afford to make many other local network attacks with different impacts. What
enter the DNS values \u200b\u200bmalware?
<=10;f++) {
DNSChanger is a family that needs a strong infrastructure to be useful. DNS servers (under the control of the attackers) from which it, which modifies the user, often housed in UkrTeleGroup Ukrainian company, under the network range 85.255.xy Nearly 10% of all machines range of addresses that correspond to public DNS servers that do not contain legitimate associations domain and IP address. Sometimes use the DNS server to associate domains the reserved IP 127.0.0.1, as is the case with Microsoft server downloads download.microsoft.com. This ensures that the victim can not upgrade the operating system security patches. Interestingly, it appears that the Apple update addresses
not blocked (although that usually affects the operating system).
also blocked a number of home pages antivirus updates. <=10; c++) {
Some of these DNS servers (WARNING: not configured in the system under any circumstances) are:
85,255,122,103, 85,255,113,114, 85,255,122,103, 85,255,112,112 ...
only requires further consultations "dig" (command to find out what addresses are related to what domains in a DNS server) to check which domains "interested" or not the attackers.
More information: Rogue DHCP servers
http://isc.sans.org/diary.php?storyid=5434
DNSChanger: One Infection, Lots Of Problems
http://www.avertlabs.com/research / blog/index.php/2008/12/16/dnschanger-one-infection-lots-of-problems /
<=10;f++) {
Source
<=10) {