Online thieves looking for personal data may be moving to more active measures by redirecting people from legitimate sites to malicious ones, security experts said this week.
The warning follows reports Friday that some people's computers were being redirected from sites such as eBay and Google to malicious Web servers that attempted to install spyware. The compromises affected 30 to 40 networks, according to Jason Lam (PDF file), incident handler for the Internet Storm Center, which tracks network threats.
"With DNS poisoning, if they intended to use it for phishing, it would have been very bad."
--Jason Lam, incident handler, Internet Storm Center
"It's hard to tell how many people were impacted by this, but it wasn't very widespread," Lam said Tuesday.
The attacks compromised servers that act as the white pages of the Internet--a key part of cyberspace that's known as the domain name system, or DNS--to replace the numeric addresses of popular Web sites with the addresses of malicious sites run by the attackers. Known as DNS poisoning, the scheme redirects Internet users to bogus sites where they may be asked for sensitive information or have spyware installed on their PCs.
The Internet Storm Center, which represents a group of incident response professionals organized by the SANS Institute, a security training organization, said that a recent flaw in Symantec's firewall and gateway security appliances likely allowed some of the DNS poisoning to occur. However, other sites that do not use Symantec products also were victims, Lam said.
"We haven't really determined what caused this," he said. "We don't have enough reported cases, so it is hard to draw a conclusion from that."
Symantec did not immediately respond to a request for comment.
Using DNS poisoning to redirect customers to sites that appear to be legitimate but actually steal sensitive information is a relatively new threat. Some security companies have called this technique
pharming.
Lam warned that future attacks, if more adeptly executed, could be nearly undetectable. It's possible users would believe they are going to a legitimate site and would get no indication from their browsers that the site that actually appears is not official.
"In this case, the content of the site was different," he said. "But with DNS poisoning, if they intended to use it for phishing, it would have been very bad."
Lam said that the site certificates used by financial Web sites and other sensitive services would give users some warning that something was amiss.
Join the conversation
Comment replyThe posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.
Chinese authorities have reportedly taken iPads from a third-party retailer, a move apparently brought on by Apple's continued refusal to honor a trademark for the iPad name owned by a Chinese manufacturer.
NY professor believes that a word-based algorithm can help bring together those who believe, with one glimpse, that they have found and lost the love of their lives.
After a higher-than-expected fourth quarter, the video subscription service unburdens itself of a pending yearlong class action suit and settles for $9 million.
Along with green-lighting Google's buy of Motorola, the Justice Department today OKs an Apple-Microsoft-RIM partnership deal to buy Nortel patents, and Apple's plan to acquire Novell patents.
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
This week, we pass around Sony's new PlayStation Vita for some hands-on testing, check out HP's newest Beats Audio laptop, and debate the best and worst Valentine's Day gadget gifts.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
Join the conversation