[166801] in North American Network Operators' Group
Re: CPE dns hijacking malware
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Tue Nov 12 01:36:06 2013
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Tue, 12 Nov 2013 06:35:51 +0000
In-Reply-To: <5281C80F.1070908@utc.edu>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Nov 12, 2013, at 1:17 PM, Jeff Kell <jeff-kell@utc.edu> wrote:
> (2) DHCP hijacking daemon installed on the client, supplying the hijacker=
's DNS servers on a DHCP renewal. Have seen both, the latter being more
> common, and the latter will expand across the entire home subnet in time =
(based on your lease interval)
I'd (perhaps wrongly) assumed that this probably wasn't the case, as the OP=
referred to the CPE devices themselves as being malconfigured; it would be=
helpful to know if the OP can supply more information, and whether or not =
he'd a chance to examine the affected CPE/end-customer setups.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton