Security threats Toolkit

Phishers pushing spyware through DNS holes

Tags:
DNS,
Poisoning,
Pharming,
Phishing

Published: 09 Mar 2005 09:25 GMT

Online thieves looking for personal data may be moving to more active measures by redirecting people from legitimate sites to malicious ones, security experts said this week.

The warning follows reports Friday that some people's computers were being redirected from sites such as eBay and Google to malicious Web servers that attempted to install spyware. The compromises affected 30 to 40 networks, according to Jason Lam, incident handler for the Internet Storm Centre, which tracks network threats.

"It's hard to tell how many people were impacted by this, but it wasn't very widespread," Lam said Tuesday.

The attacks compromised DNS servers to replace the numeric addresses of popular Web sites with the addresses of malicious sites run by the attackers. Known as DNS poisoning, the scheme redirects Internet users to bogus sites where they may be asked for sensitive information or have spyware installed on their PCs.

The Internet Storm Centre, which represents a group of incident response professionals organised by the SANS Institute, a security training organisation, said that a recent flaw in Symantec's firewall and gateway security appliances likely allowed some of the DNS poisoning to occur. However, other sites that do not use Symantec products also were victims, Lam said.

"We haven't really determined what caused this," he said. "We don't have enough reported cases, so it is hard to draw a conclusion from that."

Symantec did not immediately respond to a request for comment.

Using DNS poisoning to redirect customers to sites that appear to be legitimate but actually steal sensitive information is a relatively new threat. Some security companies have called this technique pharming.

Lam warned that future attacks, if more adeptly executed, could be nearly undetectable. It's possible users would believe they are going to a legitimate site and would get no indication from their browsers that the site that actually appears is not official.

"In this case, the content of the site was different," he said. "But with DNS poisoning, if they intended to use it for phishing, it would have been very bad."

Lam said that the site certificates used by financial Web sites and other sensitive services would give users some warning that something was amiss.