[166801] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: CPE dns hijacking malware

daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Tue Nov 12 01:36:06 2013

From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Tue, 12 Nov 2013 06:35:51 +0000
In-Reply-To: <5281C80F.1070908@utc.edu>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org


On Nov 12, 2013, at 1:17 PM, Jeff Kell <jeff-kell@utc.edu> wrote:

> (2) DHCP hijacking daemon installed on the client, supplying the hijacker=
's DNS servers on a DHCP renewal.  Have seen both, the latter being more
> common, and the latter will expand across the entire home subnet in time =
(based on your lease interval)

I'd (perhaps wrongly) assumed that this probably wasn't the case, as the OP=
 referred to the CPE devices themselves as being malconfigured; it would be=
 helpful to know if the OP can supply more information, and whether or not =
he'd a chance to examine the affected CPE/end-customer setups.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton



home help back first fref pref prev next nref lref last post