[166799] in North American Network Operators' Group
Re: CPE dns hijacking malware
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Tue Nov 12 01:13:32 2013
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Tue, 12 Nov 2013 06:12:13 +0000
In-Reply-To: <5281C31F.5080503@tiedyenetworks.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Nov 12, 2013, at 12:56 PM, Mike <mike-nanog@tiedyenetworks.com> wrote:
> It appears that some of my subscribers DSL modems (which are acting as na=
t routers) have had their dns settings hijacked and presumably for serving =
ads or some such nonsense.=20
How do you think this was accomplished? Via some kind of Web exploit custo=
mized for those devices and targeting your user population via email or soc=
ial media, which tricked users into clicking on something that accessed the=
Web admin interface via default admin credentials or somsesuch; or via som=
e direct attack on the CPE devices themselves; or via some other method?
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton