Zero Day

Websense reports China Netcom DNS cache poisoning

Posted in:

Adobe
Anti Virus
Arbitrary Code Execution
Botnets
Browsers
Data theft
Exploit code
Firefox
Flash
Google
Malware
Patch Watch
Responsible disclosure

Websense reports China Netcom DNS cache poisoning

The DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits. According to a warning from Websense Security Labs, the DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer, Adobe Flash Player and Microsoft Snapshot Viewer.

When users mistype a domain name, they are sometimes directed by their ISPs to a placeholder Web site with generic advertisements. This is typically an additional revenue source for the ISP. In the case of CNC, customers of this prominent ISP are directed to a Web site under the control of an attacker.

Websense provided screenshots of an nslookup of a potential mistyped URL. The first shows an unaffected name server, while the second shows the poisoned name server: Unaffected name server: Poisoned DNS server: A user querying an unaffected DNS server is taken through to a clean site but if the target queries a poisoned name server, the browser is redirected to the attacker's site with the malicious iFrame code:

posted by Ryan Naraine
August 21, 2008 @ 12:43 pm

Previous Post: Nokia and Sun confirm S40, Java ME vulnerabilities
Next Post: Typosquatting the U.S presidential election - a security risk?

Last 10 posts:

Opera patches 'extremely severe' security hole (11-23)
Exploit published for critical IE 7 zero-day flaw (11-23)
Inside the Google Chrome OS security model (11-19)
Microsoft finds security hole in Google Chrome Frame (11-19)
Mozilla locks out rogue Firefox add-ons (11-18)
Thousands of web sites compromised, redirect to scareware (11-17)
Microsoft confirms 'detailed' Windows 7 exploit (11-16)
Man-in-the-middle attacks demoed on 4 smartphones (11-13)
Microsoft bracing for malware attacks from embedded fonts (11-12)
Apple Safari exposes Windows to drive-by download attacks (11-11)