[ad]<\/p>\n
It’s somewhat ironic that shortly after the Kaminsky DNS bug went wild<\/a> and almost immediately got ported into Metasploit <\/a> that it was then used to attack HD Moore’s very own company BreakingPoint<\/a>.<\/p>\n It happened just a couple of days ago, it doesnt seem to have been a targeted attack though more like mass spammers\/scammers leveraging on this flaw (as expected) to divert people to scam sites.<\/p>\n It happened on Tuesday morning, when Moore’s company, BreakingPoint, had some of its Internet traffic redirected to a fake Google page that was being run by a scammer. According to Moore, the hacker was able to do this by launching what’s known as a cache poisoning attack on a DNS server on AT&T’s network that was serving the Austin, Texas, area. One of BreakingPoint’s servers was forwarding DNS (Domain Name System) traffic to the AT&T server, so when it was compromised, so was HD Moore’s company.<\/p>\n When Moore tried to visit Google.com, he was actually redirected to a fake page that served up a Google page in one HTML frame along with three other pages designed to automatically click on advertisements. <\/p><\/blockquote>\n It seems more of a problem with the ISP than BreakingPoint itself, but it still shows, if you rely on your ISPs DNS servers you don’t know what kind of fake content is getting served up to you.<\/p>\n Better safe than sorry right?<\/p>\n The flaw has to do with the way that DNS programs share information over the Internet. In a cache poisoning attack, the attacker tricks a DNS server into associating malicious IP addresses with legitimate domains, such as Google.com. Security experts say that this type of flaw could lead to very successful phishing attacks against Web surfers whose ISPs have not patched their servers.<\/p>\n Because of the nature of the AT&T hack, Moore doesn’t believe that he was targeted by the hackers. Even BreakingPoint employees didn’t realize that their internal DNS server had been configured to use the AT&T machine. Instead, he thinks that the hackers were simply trying to make a quick buck.<\/p>\n AT&T representatives were not immediately available to comment on the incident.<\/p>\n Moore believes that this type of attack may be going on at other ISPs as well.<\/p><\/blockquote>\n I wonder if they managed to con anyone? And I wonder if AT&T has fixed this problem yet? It’s surprising that such a large ISP is still susceptible to this flaw after the amount of publicity the DNS bug has gotten.<\/p>\n Just be on the watch out!<\/p>\n <\/p>\n