Networks

Ask something
Discussion Locked

DNS Spoof/Hijack/Poison

0 helpful
26 replies

by hbombvi

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm not sure what the proper terminology is in this matter, but this has been driving me nuts.

Here's the situation. In my network, DHCP is assigned by the router. Everyone once in a while (for the past couple weeks_ when my users turn on their computers they pick up the address of another computer in the network as the DNS server. Now it's always the same address and I've tracked down the computer that I believe is causing this problem but I can't find a thing wrong on it. So far I've run two full Malwarebytes scans and a full Symantec Antivirus scan. Nada!

I've checked that computer a few times now. It never fails to get the right DNS servers from the router.

Now here's the really weird part. In the past when this happened the users who got the wrong DNS entry couldn't access the Internet at all until I asked them to repair their network settings after which they get the right DNS entries. But today I've managed to surf the Internet for a full hour before I realized some slowdown and checked my DNS entry. To my surprise, it was the IP of that very machine.

Anyone ever deal with anything like this? I'd appreciate any ideas.

26 replies

by charliespencer

I've seen a similar problem caused by a laptop. The system somehow wound up as DNS server on a home network. I don't recall the details other than the problem started with a particular brand of PCMCIA wireless card (D-Link? Linksys? Details get fuzzy when you have CRS). I believe the card was configured from the factory to look for a DNS server, and if it didn't find one, it set up the system it was in as a DNS server.

All of this is out the window if you're dealing with a desktop.

by hbombvi

Yes, it is a laptop. It could account for the not finding any viruses or malware. Guess the only way I could test would be to assign him static settings. But the user is using a wired connection, not the wireless.

by charliespencer

You're original post says the problem started a couple of weeks ago. Did this laptop return from being on the road just before the problem started?
You might check the network settings and see if there's a new virtual adapter. You could run an IPCONFIG / RELEASE and then reboot. You could try a hard-coded IP address.

You could toss up your hands and re-image it. That depends on how much time you want to spend and how determined you are to find the actual source of the problem.

Good luck; I'm out of suggestions.

by mjd420nova

I've seen this happen on a couple corporate networks and found a root kit that had forced the DNS change to make all the other network nodes to access the internet through the infected unit. Turn off the infected unit, leave it off and then turn on the other units and see if that cures the problem. It should only happen when that unit is on. Then with all the other units off, just turn on the suspect unit after isolating it from the network. Monitor the task manager and see if it reveals the attempt to access the network and the internet. The unit would require a wipe if a root kit identifier/removal tool is unsuccessful.

by hbombvi

I was afraid a wipe would be the only solution. I had the problem once before and that was the only solution I could come up with. I'm certain it's this computer though as I only get calls about it when that computer is on. I'll try to find a good root kit identifier/removal tool I can try.

by matthew.balthrop

Either way, once isolated to that node the best response would probably be a wipe and re-image. The problem though is if that was a remote attack it would not be difficult for it to occur on another node on the network. Very strange though.

-alias

by hbombvi

The last time I had this issue I just wiped the hard drive. Problem solved!

Couldn't do it this time though.

by michael kassner

I wouldn't focus too hard on the computer that is being broadcast as the DNS server. If you have the workstations set up as DHCP clients they get that information from the DHCP server.

So either the router is offering that address as the DNS server or the computer in question is acting as a DHCP server and replying to DHCP requests faster than the router.

I'd check the lease time being published by the router and see if it the same as that given to the clients. To double check do a ipconfig/release and renew to see if the lease time matches.

There are exploits available for consumer grade routers that will setup rogue DNS servers, but your situation isn't exactly representing the typical exploit. I'd still be suspect of the router or check for other rogue DHCP servers on your network.

This SANS article mentions the process:

http://isc.sans.org/diary.html?storyid=6025

I'd might suggest getting a LiveCD that has a built in scanner as this type of malware is cognizant of most popular malware scanners.

by hbombvi

It's a personal laptop for an employee that's only been here a couple of weeks. It's something I really try to discourage but sometimes the higher ups block me on it.

It's looking like my only option is to tell him not to connect to our network.

by hbombvi

I work for the government. :)

Not the federal mind you. It's local. But I won't say where. LOL!

by hbombvi

No luck. Even after running several rootkit checks (found nothing) and changing to a static IP it's still doing it.

by hbombvi

I'm going to recommend to his boss that he doesn't plug his computer into our network anymore. I think he'll be more agreeable now that he just found himself hit with the same problem.

Thanks for all the help.

by hbombvi

Just to further test, I pull the laptop into my office and plugged it into an isolated hub. Then I plugged my laptop into it.

The infected laptop is definitely running it's own DHCP server. Before it seemed like only the DNS was picking up, but with just my laptop with the infected laptop I'm getting it's IP address as my DHCP server, default gateway AND DNS server. I'm surprised because I did check the services on the laptop to see if DHCP Server Services was running.

Does this offer any additional insight?

by hbombvi

That's where I got the idea to isolate the laptop in order to test it. You nailed it!

Once I update my copy of Ultimate Boot CD I'll probably try to clear whatever is causing the issue from there but for now I don't think it can cause any more harm.

by hbombvi

It doesn't kill whatever causes it, but it puts a fair bandage on it. The best solution I could come up with was to block his DHCP ports with a firewall. I installed Comodo and blocked ports 67 and 68. With the static IP he can still use the Internet. As long as he never needs to use a wired connection anywhere else he'll be fine.

This will at least keep him out of my hair until his office assigns him a work PC.

Thanks again for all the help everyone.

by michael kassner

I didn't think of using a firewall on the computer in question to block outgoing traffic, very cool.

I'm guessing it might be:

Trojan.Flush.M

If you want to check it out.

This discussion is closed to new replies.