Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Networking IT

TimeWarner DNS Hijacking 339

Posted by kdawson from the can-you-spell-ham-handed dept.
Exstatica writes "It looks like TimeWarner is taking vigilante action on the botnet problem. They've hijacked DNS for a few IRC servers, the latest being irc.mzima.net and irc.nac.net — both part of EFNet. (irc.vel.net was hijacked earlier but has been restored.) Using ns1.sd.cox.net, the lookup returns an IP for what looks to be a script that forces the user into a channel and issues a set of commands to clean the drones. There have been different reports of other IRC networks being hijacked and other DNS servers involved. Is this the right way to handle the botnet problem? Is hijacking DNS legal?" Botnets are starting to move off of IRC for command and control, anyway.
Update: 07/24 00:01 GMT by KD : Updated and added more links; thanks to Drew Matthews at vel.net. 07/24 11:52 GMT by KD : Daniel Haskell wrote in to say that ircd.nac.net is seeing cox.net connections again, and that they are in discussion with the EFF over the matter.
This discussion has been archived. No new comments can be posted.

TimeWarner DNS Hijacking More

TimeWarner DNS Hijacking

Comments Filter:

  • New Update since i submited this yesterday (Score:5, Informative)

    by Exstatica ( 769958 ) * on Monday July 23, 2007 @07:52PM (#19963505) Homepage
    Since submitting this article yesterday there have been some new developments. There was a large debate on Nanog about what has been happening and eventually was published to wired [wired.com]. The full description of everything that has happened and how it happened can be found on my site at http://www.exstatica.net/hijacked/ [exstatica.net] as for irc.vel.net we have been returned our dns, but irc.mzima.net appears to still be hijacked.

    • Re:New Update since i submited this yesterday (Score:4, Interesting)

      by Anonymous Coward on Monday July 23, 2007 @08:51PM (#19964027)
      This is in no way a new practice -- Time Warner has been doing this for well over two years. In the past script kiddies who have been caught hosting botnet servers on *.res.rr.com machines had their DNS's redirected to a single server in which all registered IRC users would be directed to #badbotbad, with the topic as .remove. It did, and still does, little to stop the botnet problem since the methods TW uses to sniff out the botnet servers are very specific to IRC protocol. That, and the server would only remove a standard kiddie rxbot with unchanged commands. --Manix

  • This is a DNS hijacking. (Score:5, Funny)

    by woodchip ( 611770 ) on Monday July 23, 2007 @07:56PM (#19963551)
    OK DNS Server resolve me to .cu and no body gets hurt.

  • The criminal code calls it "Theft of Services" (Score:5, Interesting)

    by cenonce ( 597067 ) <{anthony_t} {at} {mac.com}> on Monday July 23, 2007 @07:58PM (#19963563)
    In Pennsylvania, it sounds like it might fall under Theft of, or Diversion of Services. [aol.com]

    • No, probably not (Score:5, Interesting)

      by Sycraft-fu ( 314770 ) on Monday July 23, 2007 @09:50PM (#19964479)
      Since it sounds like they were doing it with their DNS servers. While it would be illegal for me to break in to your DNS server and modify it, it is not illegal for me to modify my DNS server, even if you use it. If you dislike it, you can use another service, but unless I have a contract with you there's nothing wrong with it (legally). You can argue it is a bad idea, but changing their equipment on their network is well within their rights.

      • Alternative DNS? (Score:2, Insightful)

        by SaDan ( 81097 )
        208.67.222.222
        208.67.220.220

        I don't work for OpenDNS, but they've got some nice DNS servers out there for use. http://www.opendns.com/ [opendns.com]

        Kind of sad, the first thing I thought about when I started reading about this was, "Wow... Who'd a thought you needed TOR to get proper DNS resolution?"
        • I thought OpenDNS was the greatest thing, until I noticed if you type in a URL that isn't valid it doesn't deliver the standard "non-existent domain" return, but instead gives you an OpenDNS search results page. Bleh. I'll stick with running Bind on my own server, thank you.

          • Re:Alternative DNS? (Score:5, Insightful)

            by dissy ( 172727 ) on Monday July 23, 2007 @10:45PM (#19964887)

            I thought OpenDNS was the greatest thing, until I noticed if you type in a URL that isn't valid it doesn't deliver the standard "non-existent domain" return, but instead gives you an OpenDNS search results page. Bleh. I'll stick with running Bind on my own server, thank you.
            Actually, if you signup for a free account, and add your IP(s) in their dashboard webapp, you can configure all sorts of things, including to return NXDOMAIN on resolution failure.

            I too agree that breaking NXDOMAIN is a bad thing, but OpenDNS at least does let you change this yourself. It just has the wrong default, so to speak.

            I strongly urge you to signup for a free account, and look over their settings available, before you judge.

            -- Jon

      • Re: (Score:3, Informative)

        by stonecypher ( 118140 )
        The law doesn't seem to agree with you. From the thing you didn't read: (b) Diversion of services.--A person is guilty of theft if, having control over the disposition of services of others to which he is not entitled, he knowingly diverts such services to his own benefit or to the benefit of another not entitled thereto. Whether that benefit is monetary doesn't seem to matter.

        It turns out that when you're a telecommunications provider, there are a whole bunch of laws to the effect of "you can't divert or

      • Since it sounds like they were doing it with their DNS servers.

        NO!! This goes far beyond DNS and is extremely irresponsible!!

        A DNS response to a widespread bot infection, a worm attack, or other overwhelming threat would be to claim SOA for the offending domain on your network, and resolve the entire domain to 127.0.0.1. Even that's sketchy, but it's what we might call the internet equivalent of Generally Accepted Accounting Principles. I've seen registrars themselves nullroute a domain and in general ther

        • A DNS response to a widespread bot infection, a worm attack, or other overwhelming threat would be to claim SOA for the offending domain on your network, and resolve the entire domain to 127.0.0.1. Even that's sketchy

          Indeed. It goes even farther -- I don't particularly like efnet, but I do imagine there are still legitimate chat and discussions going on between real human beings. So resolving it to localhost means legitimate connections that have nothing to do with the botnet are dropped in order to stop t

  • Yes, it is the right way (Score:2, Interesting)

    by Anonymous Coward
    Politicians are more concerned with pampering the amok-running entertainment industry, providers are more concerned with keeping their pink contract customers, users are more concerned with getting cheap viagra and don't care about the number of botnets their computers are part of and law enforcement is chasing whoever is tagged with the kiddieporn or terrorism flag.

    If admins don't take it into their own hands, nobody is going to do anything.

  • IRC networks must police themselves (Score:2, Interesting)

    by Anonymous Coward
    Police thyself, or others will do the policing for you.
  • Then they came for IRC, and dammit, I use IRC, and if my ISP blocks it, it's a dealbreaker, even if I have to sue to cancel the contract.

    • Re: (Score:2)

      by twitter ( 104583 )

      I use IRC, and if my ISP blocks it, it's a dealbreaker, even if I have to sue to cancel the contract.

      Next level time, apt-get install bind.

  • TimeWarner != Cox (Score:3, Informative)

    by OverlordQ ( 264228 ) on Monday July 23, 2007 @08:01PM (#19963605) Journal
    While Cox used to use Time Warner's RoadRunner for their cable internet service, Cox's Internet offerings are In-House now.
  • If Time Warner was really concerned about it wouldnt it be easier and more effective to use their virtual truck (TW Self help) application to redirect the users browser start page to a list of instructions, tools and a support number to clean up their system? I have seen several instances were they redirect users to a "disabled due to non-payment" type pages...would a "Hey idiot your computer is infected" page be that difficult?

    • Re:Is there an easier and more effective way?? (Score:5, Interesting)

      by sqlrob ( 173498 ) on Monday July 23, 2007 @08:08PM (#19963685)
      Knowing them, yes, and probably not a good idea.

      A while back, I got a "your computer is infected" notice from them. I checked all my computers, the Windows ones with tools that weren't even available to the public at the time, and zero, zip, nada. Everything was clean, sniffs showed nothing out of place.

      Finally talked with someone with a clue, and they classified my SpamAssassin install as a DOS on their name servers because they were caching the negative responses from the various blacklists.

      • What??? (Score:5, Interesting)

        by bogie ( 31020 ) on Monday July 23, 2007 @08:48PM (#19963999) Journal
        You mean you actually talked to someone in tech support who not only knew what a packet was but also looked up what was happening on their end at a technical level? How many drones did you have to speak to telling you to A)reboot or B)reinstall your machine? Did you use chicken blood or ox blood to perform this magic?

        • Re:What??? (Score:4, Informative)

          by Martin Blank ( 154261 ) on Monday July 23, 2007 @09:11PM (#19964177) Homepage Journal
          Actually, if you can get past the first level of drones (and sometimes the second level, depending on the company), you'll talk to people who know not only what a packet is, but also can do actual troubleshooting on the modem connection and make some sense of it. I've experienced this with Comcast, Adelphia, and Time-Warner (it was completely absent, so far as I could tell, from MediaOne when they were around); in one case, I got a very thorough explanation of the problem as it related to head-end equipment and what needed to be done to fix it from the tech as she was entering it into the work order.

          The problem, of course, is that almost all users that call in don't need more than scripted hand-holding, and those of us that know what we're talking about call in and hit that wall, through which it can be very difficult to find an open window through which to crawl to find a knowledgeable person.

        • Re: (Score:2)

          by sqlrob ( 173498 )
          Damn if I know. It's taken me 20-30 minutes at time to convince them problems are with their mail server, not my computer. If someone mention telnet and SMTP in the same sentence, just escalate them.

          Maybe because this one was initiated by them and not me?

  • About time (Score:2, Insightful)

    by beefcake1942 ( 996262 )
    Frankly, I think it's about time somebody started ACTING on the problems we face online. Botnets are a huge global issue, and we simply must do all that we can to stop them. Although I suppose this probably could be considered illegal (remotely installing software on somebody's PC without their authorisation breaks pretty much every anti-hacking law in the land), how else can we tackle these issues? Zombie PCs aren't going away any time soon, so more needs to be done. The only problem is as the OP origin

    • Botnets are a huge global issue, and we simply must do all that we can to stop them.

      No matter the collateral damage? Protecting freedom by restricting rights again, are we?

    • Re:About time (Score:5, Insightful)

      by CrazedWalrus ( 901897 ) on Monday July 23, 2007 @09:54PM (#19964503) Journal

      I think this action is right-on. The parts of the equation missing are trust and accountability.

      We don't trust vigilantes, not because we don't agree with them, but because we don't trust them to always act in the greater good. Their future actions and motivations are unknowns. Since their identities may even be secret, there's no way to hold them accountable.

      Why are we ok with the police taking the same actions as a vigilante would take? Because of trust earned through accountability. To retask a familiar saying: "Put all your eggs in one basket and then watch that basket". That basket is the police, and we've put all our eggs in it. That means the public at large can watch the police, who are well-known and generally easy to spot. It means that internal controls can be set up, and rules of engagement can be put in place. We trust the police as much as we do because we know that, ultimately, they're under the control of the general public, who can exert pressure on them when they act badly. This is why we tend to put more trust in organizations, rather than individuals. Organizations are easier to censure.

      Understanding that, it's easy to see what the course of action needs to be. As much as we here at /. tend to have a love/hate relationship with authorities, I think one needs to be set up specifically to deal with these problems. They need to be given what power is necessary to deal with the problems like spam, trojans, botnets, whatever, but at the same time, they need to be directly accountable to the public in a similar manner to police forces. Legitimize the vigilante action by coupling it with accountability.

      I don't really know the specifics of setting up something like this, but I think using the police as a model would be the way to go. Rules and procedures, all the requisite bureaucracy, but also the ability to launch tactical "busts", "cyber" or otherwise. They'd need all the same approvals, warrants, etc. They'd have branches in all concerned countries, and would work through the legal systems in their home countries. In some countries, they might be a part of the police force, since much of the administrivia would be similar. Ultimately, I'd think CERT or something like it would be a good headquarters or parent organization for such a group.

      The point is that we've already worked this out in the "Real World". Applying it to The Internet shouldn't be a patent-worthy exercise. While I wish we didn't need government involvement, much of the authority required is the type of authority that only government can legitimately grant, such as the ability to seize equipment.

      I aplogize that this isn't as eloquently described as I'd have liked, but I think the general idea is there. You may now procede to flame me for advocating the Policing of the Intertubes but ultimately, I think that's where we're headed.

  • Anything goes on the Eris Free Network.

    • Re: (Score:3, Funny)

      by Vegeta99 ( 219501 )
      Except for Eris, of course.

    • Re: (Score:3, Interesting)

      by dougmc ( 70836 )

      Anything goes on the Eris Free Network.

      OK, it's nice that you know what EF stands for in EFnet, but what you may have missed is that when the IRC network (it didn't have a name back then -- it was just `IRC') split, it split into AnarchyNet (or just Anet) and Efnet. There was no need for names before that, but after that, those are the names that were chosen.

      Anet was the one where `anything goes', and yes, it did have a server called eris. The big thing that went on Anet that didn't go on Efnet was that new servers didn't need a password

  • Another vote for OpenDNS! (Score:5, Insightful)

    by sillivalley ( 411349 ) <{sillivalley} {at} {comcast.net}> on Monday July 23, 2007 @08:07PM (#19963673)
    So we can expect the next generation of malware to alter systems to use OpenDNS?

    Might make some systems a little more useful!

    • "So we can expect the next generation of malware to alter systems to use OpenDNS?"

      I remenber a fella named Kashpuereff tried this once...

  • About Time Someone Tried Something (Score:2, Insightful)

    by Anonymous Coward
    Let's face it, the company with the most responsibility in the Botnet mess, Microsoft, has been sitting on their hands when it comes to dealing with the issue. Well, until they figured out they could make a buck at it.

    Botnets are used by organized crime for spam, stock scams and a host of other illegal activities. It's time someone did something...if only for the political effect.

  • The Right Way? (Score:5, Funny)

    by Kozar_The_Malignant ( 738483 ) on Monday July 23, 2007 @08:13PM (#19963725)

    >Is this the right way to handle the botnet problem?

    No. The right way involves castration with rusty linoleum knives, Turkish prisons, and rabid wolverines. If that doesn't work, we should quit being nice and get nasty with these folks. Seriously, this problem will not go away until people start doing some hard time, preferably with a cell mate who does not need Erct|le Member Help!

  • ...the sudden increase in irc proxy scanners hitting my server over the past week.

    Though I'm not sure what kind of explanation justifies doing that.

  • This will NOT raise awareness or work in any way. (Score:5, Interesting)

    by twitter ( 104583 ) on Monday July 23, 2007 @08:18PM (#19963783) Homepage Journal

    Wired found someone who approves of breaking the internet:

    Frankly, redirecting requests to malware sites, or IRC communication channels, to cleaner-sites sounds like a practical short term tactic to me. And if it raises awareness around the seriousness of the bot problem I'm all for it.

    Right, because the kind of people who might actually use IRC know nothing about botnets and the kind of Windoze users who are part of the botnet care about IRC. This is just another attack on the free software community as outlined in the Haloween Documents.

    Once again, the ISP has punished the good guys for problems crated by the bad guys. The root cause of the botnet is Windoze. Fixing it and raising awareness is as simple as cutting the problem computers off your network and telling their owners why. This is as it should be and pretending otherwise props up third rate software and threatens the stability of the net.

    • Re:This will NOT raise awareness or work in any wa (Score:5, Insightful)

      by thegrassyknowl ( 762218 ) on Monday July 23, 2007 @08:35PM (#19963913)

      Once again, the ISP has punished the good guys for problems crated by the bad guys. The root cause of the botnet is Windoze. Fixing it and raising awareness is as simple as cutting the problem computers off your network and telling their owners why. This is as it should be and pretending otherwise props up third rate software and threatens the stability of the net.

      I wish I hadn't run out of mod points; this is gold.

      That's a pretty cut and dried way of reducing the number of bots. Cutting the user off forces them to understand what is wrong and why they're cut off. If you just give them information most will just click past it and continue on their merry way. Users don't want information. They want the pr0nz as quick as possible. Didn't you know that?

      I can think of one case where a (now ex) friend of mine would email To: every single person in her work address book with SPAM for her work. I started out telling her to use the Bcc: field at least and pointed her to a web page describing why you'd want to do that. she replied "I don't want to read all that technical garbage" then carried on the same. Then I asked her to remove me from her list. She replied "I am going to send you this stuff because I know you want it" (it really was SPAM for her work, it wasn't even jokes or chain mail). There ended our friendship as I reported them to their ISP. They were warned by their ISP and still continued doing what they did. They lost hosting pretty quick after that.

      People don't want to learn. They are, by and large, idiots. Heavy handed measures are the only way to force them to realise that fact.

    • Other than that aimed at users being responsible for their own computers. The botnet's root cause is not "Windoze", it's the people who are ignorant or lazy enough to let their computers be taken over by trojans and worms. Since it's stupidly simple to avoid that, the problem lies squarely between keyboard and chair.

      I expect that the same people who neglect their PCs by downloading and opening random crap and not even bothering to leave automatic updates running will be as detrimental to OS X or Linux if

      • Leet-man dedazo insultingly blames the users again:

        The botnet's root cause is not "Windoze", it's the people who are ignorant or lazy enough to let their computers be taken over by trojans and worms. Since it's stupidly simple to avoid that, the problem lies squarely between keyboard and chair.

        Both ignorance and apathy would be cured by kicking off infected computers. I'd be looking forward to "responsible user" dedazo being kicked off but I think the PR firm he works for uses a botnet to post all it's

        • Re: (Score:2)

          by dedazo ( 737510 )

          Both ignorance and apathy would be cured by kicking off infected computers

          Well, yes. That's one solution I guess.

          I'd be looking forward to "responsible user" dedazo being kicked off

          Unfortunately for you, none of my "M$ Windoze" machines are in any botnets, have any malware or are otherwise compromised, much like many other hundreds of millions of other PCs running "Windoze" out there.

          I think the PR firm he works for uses a botnet to post all it's pro M$ blather

          Jeepers, you are so cool.

          Steve Jobs d

        • Re: (Score:2)

          by Mr2001 ( 90979 )

          Leet-man dedazo insultingly blames the users again

          Well, look: it almost certainly is their fault that they got infected. You don't have to be a super genius to avoid getting infected, you just need enough self-control to not install every search toolbar or smiley-face cursors package that comes along.

          That doesn't mean the OS is blameless, though - it can and should be more difficult for idiots to get themselves infected. But educating the users would be more effective. If they all switched to Linux, they'd just start clicking stuff like "Get 1000 free KDE

        • Re: (Score:2)

          by cdrguru ( 88047 )
          First person that installs WeatherBug (or its Solaris equivalent) in a hospital gets their final check that day. They are gone.

          There is no substitute for educating the users.

      • Re: (Score:3, Insightful)

        by QuantumG ( 50515 )
        No, no, and no.

        The problem is the assholes who take over people's computers to send spam and flood web sites.

        The solution is a well funded police force to hunt them down.

        • Re: (Score:2)

          by dedazo ( 737510 )
          Well, of course it's the criminal's fault, not the victim's. The victims could do (or not do) a hell of a lot more to avoid being "victimized", though.

        • Re: (Score:2)

          by cdrguru ( 88047 )
          Problem is that you can't convict anybody of anything when the Internet is involved.

          How do you prove, even with a preponderance of the evidence, that person X was at the keyboard instead of person Y. Or it might have been Z out in the parking lot on an open access point. You can't prove it, so no prosecution is possible.

          Same goes for the RIAA it would seem.

        • Re:No "awareness" needed (Score:5, Insightful)

          by ScrewMaster ( 602015 ) on Monday July 23, 2007 @10:53PM (#19964949)
          I think a well-funded spec-ops team would do even more. Make these guys disappear. I mean, hell, if we're gonna live in a police state, we might as well enjoy a few of the fringe benefits.
    • This is just another attack on the free software community as outlined in the Haloween Documents.

      Actualy they only modified their own DNS server. This is not breaking the Ineternet. This is breaking Cox/Time Warner walled garden ISP DNS.

      If you don't like the faulty DNS, feel free to change to one of the other public DNS servers such as the public Verison DNS Server at 4.2.2.1. You don't have to use your ISP's DNS server. Go into your router setup and switch from dynamic DNS to Static and plug in 2 or 3

  • Their DNS Server... (Score:5, Insightful)

    by flyingfsck ( 986395 ) on Monday July 23, 2007 @08:28PM (#19963855)
    If I wish to black hole something on my DNS, it is my prerogative to do so. If someone else is using my server for free and complains about the shitty service, then I'll gladly refund his money...

    • Re: (Score:3, Interesting)

      by DarkOx ( 621550 )
      Yes, but arguably DNS is a services you expect your ISP to provide. I know I do. I rather like my ISPs DNS server, its fast and near to me in terms of hops. Its a great forward DNS server for the DNS server on my personal network.

      I expect my ISP to provide me with correct DNS loopup results. If they don't then they would not be providing me with part of the service I understand I am paying them for. They would hear from me about it pretty quickly and more then likely loose my business over it. There ar

    • Re: (Score:2)

      by vux984 ( 928602 )
      Remember how well that worked for email. If you don't want to use your ISPs SMPT server because you didn't like their policies you could just run your own. Now, many of them do their absolute damnedest to force you to use theirs by blocking access to others... all in the fight against spam.

      If the botnets/etc get wise to the fact that the ISPs are fucking with DNS, they'll just start dodging the ISPs DNS service, like the spambots dodged the ISPs smpt server.

      The obvious ultimate outcome - the ISPs force you

  • It's not like the police are doing anything.. (Score:5, Interesting)

    by QuantumG ( 50515 ) <qg@biodome.org> on Monday July 23, 2007 @08:31PM (#19963881) Homepage Journal
    Uhhhh.. see, I'm kinda of the opinion that vigilante action is only bad if there are proper channels. There are none.

  • only extends to where someone else's nose begins. If someone is harming your chattels, then you have the right to take appropriate action to limit the damage. I'd love to see a botnet operator sue Time Warner - "Judge it is not fair, they hit back first! Waaaaaahhhh..."

  • I have mod points, but I'd like to collectively reply to a few of the comments I see here. for those of you that are commending this act of vigilantism, stop and think - is this the most effective way to tackle the problem? The way I see it is that being a vigilante is akin to being involved in a constant game of whack-a-mole. The only problem is that when you start taking down bots (or even whole botnets), the people running them begin to realise that their current generation of malware isn't effective enough, and create something that is harder to detect. As the summary notes, we've already seen [slashdot.org] them trying to improve their resources. There was another post I saw on here that put it more eloquently, essentially saying: vigilantism only helps the bad guys work out where they need to improve.

    So how about instead of trying to fight a brushfire with an extinguisher, we get to the root of the problem and start educating users. Yes, that takes effort. I can't begin to count the hours I've spent trying to explain to folk why using an alternative browser (or OS or whatever) is a good idea, and what they should look for in a reputable site, and so on and so on ad nauseum. It's a slow process, but the more people that are aware of the risks - and more importantly, the reasons for the risks - the less there potential 'marks' there are for all the script kiddeez, rooters and organised criminals out there.

    And for us on /. - less requests to fix the family computer when we visit at Christmas.

    • Have you walked down your street, knocking on doors, offering to educate them? It doesn't work too well. I tried it as a 'break the ice' to help secure unsecured networks from my neighbors (live in a single family home neighborhood, not an apartment complex) right after we moved in. A lot of people looked at me odd, and only one wanted to know about it, out of the 7 homes I tried before quitting. I'd walk the culdesac with my iBook showing them how anyone could log on and just a simple WEP password wou

      • Actually, I haven't proffered my services like that, but I actually think it's a good idea. When I move into my next apartment (looking for a place at the moment) I think I'll give it a shot. As you say it may not have a great success rate but it is a good icebreaker.

        I'd recommend other folk try this too - it can come in very handy to have a reputation as 'that helpful guy in the building / on the block'.

    • Re: (Score:2)

      by QuantumG ( 50515 )
      There's no hope of that.

      We need a dedicated police force to track botnets and their creators and run them to ground.

      In fact, we need a specially trained police force in every country in the world with international co-operation between each of them.

      I suggest that we fund it with an "Internet License" and that could include some education component (but don't get too excited, it won't be anything useful).

      • Re: (Score:3, Interesting)

        by BertieBaggio ( 944287 ) *

        When I first read your post I thought you were trying to make a dry joke, but I figure from your other posts that you are serious. If you really want a dedicated police force for this sort of thing why not show local politicians that it is feasible, important, and not a waste of money (the last one is the most important). If you can give them an example ("Here is a guy I tracked down in 5 hours. He controls 10,000 bots he can do $50,000 worth of damage an hour. He has probably misappropriated 1000 identitie

  • Not perfect, but (Score:4, Interesting)

    by davmoo ( 63521 ) on Monday July 23, 2007 @09:06PM (#19964117)
    This isn't the perfect or ideal way to do things. But its about damned time the ISPs did something.

    There is simply **NO** excuse for a bot to be running on any ISP for more than the time it takes to detect it pumping out massive volumes of email. My solution, as I've stated several times, would be to disconnect the offending computer, and then fire them off a snailmail letter stating that they will not be permitted back until their computer is disinfected. But since that would cost them customers, no one will do that.
    • There is simply **NO** excuse for a bot to be running on any ISP for more than the time it takes to detect it pumping out massive volumes of email.

      So, all they'd have to do is to watch egress traffic, and if somebody was sending mail to, say, more than 20 different e-mail servers in the course of an hour (perhaps with a ramp-up capability), then suspect they're a spammer and either a) get them on a whitelist if they're not, or b) prevent them from sending more mail unless it's properly relayed.

      Now, how do y
  • http://secureme.blogspot.com/2005_06_01_archive.ht ml/ [blogspot.com]

    Scroll down to the very bottom of that page. Notice the date.
  • This might give us some brief reprieve, timewarner needed to do this to prevent their network getting banned in places, i already banned it from my mailservers. the botnetters will just use ip addresses next...
    • They can use IP addresses all they want. TW can easily just reroute where it goes on their network. Hijacking the DNS request is just a simple means of accomplishing this. Not to mention these people won't be able to hide so well if they actually use an IP address.

  • I can easily understand the urge to disable as many bots as possible, particularly those that are making their network look bad.

    At the same time, they're blocking legitimate accesses to legitimate services without even notifying their users.

    I don't really mind that they're manipulating the machines given that they only affect owned machines.

    This does seem to be a vigilante action, but it's not as if "legitimate" law enforcement seems to have any interest at all in catching cyber-criminals even when th

    • It's not vigilantism...TW has the right to protect their network, and what you do on it if it's harmful to it. They could just kick users off entirely. Trust me, they have no issue with it. They will actually terminate accounts if you get infected with a viri one too many times. I've had friends who it's happened to. When people won't listen theres only one way to fix a problem. Be a dick, and take care of business.

  • Tortious Interference (Score:3, Interesting)

    by Spazmania ( 174582 ) on Monday July 23, 2007 @09:48PM (#19964461) Homepage
    Is hijacking DNS legal?

    "Tortious interference," is part of english common law roughly defined as the causing of harm by disrupting something that belongs to someone else. The original example was a guy who repeatedly drove ducks away from his neighbors' pond by firing a gun in the air on his own property.

    So no, its not legal. But if you want to pursue it in court, you have only one of the weaker common-law torts to rely on.

  • Hijacking, and San Diego Cox Communications (Score:5, Interesting)

    by CherniyVolk ( 513591 ) on Monday July 23, 2007 @11:22PM (#19965149)

    First, as a person who owns and operates many networks, I would be rather annoyed that someone has hijacked one of my domains, for any purpose.

    To me, a domain name is the equivalent to a land deed, it's a peace of virtual real-estate. It's a representation and label identifying a group of IP addresses which may or may not be associated to a physical device or service. If I have a problem with some other network, I attempt to contact the powers-that-be of the offending network; in good faith, that they would be cooperative.

    Now, I assume many offensive networks out there might not cooperate, or might think that what their network is doing is either legal, moral, or of no harm. Well... I do admit, I block all of APNIC to my mail servers, though, I do not service "customers" either. If I did, I would assume my customer demographic might include a need or desire for correspondence with those in APNIC, and permit the traffic. While I might, on case by case scenerios, filter a range of IPs known for SPAM or whatever, things I certainly wouldn't do is hi-jack a domain, and most disturbingly, attempt to execute code on a clients machine without direct consent for each instance, each time. Basically, what you're doing then is intentionally deceiving a computer system, breaking standards, breaking and entering said computer system, and influencing change which permanently alters HOW that computer operates. And, knowing the practices and the broad generalized sweeping tactics of Cox Communications (for example), I must say I do NOT trust what they MIGHT consider as "malicious" code to delete off my computer "at their whim".

    If this becomes "legal", then what's to stop Cox Communications (for example), from considering my MP3s as "malicious or of questionable origin" and on behalf of RIAA, delete my mp3s? How are they going to know?

    Now, on to San Diego Cox Communications. While I agree that if you are on someones network, you do what they say. However, as already implied above, if my intention is to provide "Internet Service", then I DO inherently forfeit some of that overall power. And Cox Cable, blocking incoming and outgoing ports is really not within their moral obligation to do so. Nothing illegal about them doing it, no doubt some here might agree with them. But, if I'm going to sell someone "Internet Service", as I have in the past, they get "Internet Service" in full. I don't want a parent above me, and most certainly, I should be allowed unaltered Internet Service from Cox Communications on request against the default safegaurds in-place for the sake of the laymen.

    But, Cox Communications does NOT permit one to exercise all of the technologies available. They notoriously block ports, and muck with the traffic. Why? Who knows, and I don't mean to be elitist, but their explanations of some Windows worm really doesn't apply to my Linux box. Besides, if I was running Windows, I still wouldn't appreciate all the port blocking and crap. I'll handle that myself.

    As a result, I refuse to use Cox Cable or Time Warners Road Runner services. (Aside from the fact I'm banned from San Diego Cox Cable's network for running VPN clouds on their network, among other things like DoS'ing everyone on my subnet to boost my download speeds...), I warmly welcome other high-speed services that do NOT play parenthood. Sadly, one practically has to purchase a "Business" line instead of a "Home" connection. So, that's in fact what I have so if I want to launch my own webserver/mailserver, SQL Server or whatever, it's simply a matter of just configuring and launching the daemon.

    In short, I feel hi-jacking is wrong. And I feel that people should not use Cox Cable as they are the "AOL" of today anyways. Such actions are so typical of Cox Cable... it's truelly ridiculous.

  • Killing Fly with a Bazooka (Score:5, Interesting)

    by madsheep ( 984404 ) on Tuesday July 24, 2007 @12:05AM (#19965473) Homepage
    Well as some have pointed out you can use other DNS servers. However, many people don't have the time/knowledge/or need to mess with this and they really shouldn't have to. Messing with DNS for these purposes is a questionable activity. However, especially in the case of EFNet servers, I find this especially strange. EFNet does have some botnets that end up with them, but they are very few and far between.. and small in nature. These things are taken down pretty rapidly on EFNet and that's part of the reason they're not used frequently. DALnet -- a whole other story. There's tons of active botnets there now. EFNet is definitely much smaller in scale n terms of the number, the size, and the lifespan. This is pretty sad. Redirecting a hacked server being used by an IRCD is one thing. Doing it selective IRCDs on a huge *legit* network.. that's a whole other story.

  • Transcript of IRC (Score:4, Informative)

    by simpleguy ( 5686 ) on Tuesday July 24, 2007 @01:53AM (#19966019) Homepage
    [ simple1 @ saturn ] ~ $ dig @ns1.dc.cox.net irc.mzima.net
    irc.mzima.net. 300 IN A 70.168.70.4

    Connecting to 70.168.70.4 (70.168.70.4) port 6667.

    [JOIN] You are now talking on #martian_
    [MODE] localhost.localdomain sets mode +n #martian_
    [MODE] localhost.localdomain sets mode +t #martian_
    [TOPIC] Topic for #martian_ is .bot.remove
    [TOPIC] Topic for #martian_ set by Marvin_ at Tue Jul 24 09:48:56 2007
    [TOPIC] Topic for #martian_ is .remove
    [TOPIC] Topic for #martian_ set by Marvin_ at Tue Jul 24 09:48:56 2007
    [TOPIC] Topic for #martian_ is .uninstall
    [TOPIC] Topic for #martian_ set by Marvin_ at Tue Jul 24 09:48:56 2007
    [TOPIC] Topic for #martian_ is !bot.remove
    [TOPIC] Topic for #martian_ set by Marvin_ at Tue Jul 24 09:48:56 2007
    [TOPIC] Topic for #martian_ is !remove
    [TOPIC] Topic for #martian_ set by Marvin_ at Tue Jul 24 09:48:56 2007
    [TOPIC] Topic for #martian_ is !uninstall
    [TOPIC] Topic for #martian_ set by Marvin_ at Tue Jul 24 09:48:56 2007 .bot.remove .remove .uninstall
      !bot.remove
      !remove
      !uninstall

    Thats it.

  • The Golden Rule (Score:3, Informative)

    by BillGatesLoveChild ( 1046184 ) on Tuesday July 24, 2007 @03:22AM (#19966415) Journal
    OP asks "Is this the right way to handle the botnet problem? Is hijacking DNS legal?""

    A good question. Let me check for you.... Hang on... looking up Time Warner's Bank Balance. Uh huh... HOLY COW!

    In answer to your question, yes, DNS hijacking is most definitely legal.

  • This is the ISPs fault (Score:3, Informative)

    by humankind ( 704050 ) on Tuesday July 24, 2007 @10:36AM (#19969411) Journal
    I find it ironic that Time Warner is going at this from the wrong end of the problem. If they filtered port 25 traffic from broadband DUL space, the spammers wouldn't be interested in invading their customers' machines. It's almost always about spam. The fact that most of these ISPs do little to stop their customers' machines from being zombied, or anything to reduce the viability of them being exploited, shows how much they really care about the customers. All broadband ISPs should now be filtering SMTP traffic on their networks. Anyone that wants to run their own mail server can set up alternate ports and use special IP space designated for SMTP traffic. This would make the botnets obsolete.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close