Warning to BT broadband owners

[130R]

Having personally seen this last week I have no doubt that BT's DNS servers have been hacked. If you go to google (for example) and see dns.sysip.net in your status bar when the page is loading then you are affected by this. I don't use IE but it is easy to see this in firefox. If this is happening to you then look at the page source code and you will see the javascript that has been injected into the page.

http://en.wikipedia.org/wiki/DNS_cache_poisoning

I managed to get rid of it eventually by using ComboFix with ccleaner, running ipconfig.exe /flushdns and then rebooting. Although I had previously got rid of it and it came back again ...

[tigger1]

Parle tu en Francais?

-cos I'm buggered if I understood what you just said.

Is a DNS hack a problem for the user?

(My French is slightly better than my understanding of network exploits, just!)

[130R]

tigger1 said:

Is a DNS hack a problem for the user?

Yes, because by routing you through dns.sysip.net they can steal any information you enter. I would call that a pretty serious problem!

[trackcar]

My bro in law is on BT broadband .. would this affect him? would he have had to do anything at his end for this re-routing to have taken effect or is it a BT issue ie out of his hands until he notices it's happened?

[Glassman]

trackcar said:

My bro in law is on BT broadband .. would this affect him?

No. In-laws are exempt.

[130R]

trackcar said:

My bro in law is on BT broadband .. would this affect him? would he have had to do anything at his end for this re-routing to have taken effect or is it a BT issue ie out of his hands until he notices it's happened?

It could affect anyone who is on BT broadband as far as I know. And yes, it is a BT issue. Most people won't notice it is happening at all.

[trackcar]

okie dokie, thanks

[SGirl]

If only I had this problem!! I'm still without a broadband connection, almost a week after reporting the problem. The geniuses at BT "accidentally" put a cease order on my broadband, despite me making it very clear I rely on the link for business, and despite a so-called fasttrack order I'm still without broadband.

Seriously fed up with BT now. They've cost me a fortune this week in lost sales and time.

[cottonfoo]

I've not had any problems with this, and I'm using BT Yahoo at home.

[GreenV8S]

Presumably, if this was happening then a DNS lookup of an affected name would return the wrong address.

So for example www.google.com currently maps to addresses 66.249.93.104, 66.249.93.147, 66.249.93.99. What do you get if you run nslookup www.google.com on your affected machine?

[FourWheelDrift]

Anyway to check this if you Google page loads so damn fast you can't see what it says on your status bar?

[Podie]

Noticed it was a tad slow to respond last night... will do some digging.

TIA

[130R]

More info here:

http://www.digitalspy.co.uk/forums/showthread.php?...

Seems it may be looking for the Firefox 2.0.0.4 user agent because that is what I was using

[Pvapour]

Glassman said:

trackcar said:

My bro in law is on BT broadband .. would this affect him?

No. In-laws are exempt.

& Out-laws obviously

ps - thanks for the heads up 130

Edited by Pvapour on Thursday 5th July 14:11

[Who me ?]

130R said:

More info here:

http://www.digitalspy.co.uk/forums/showthread.php?...

Was either on this post ,or the link that i saw microtrend.
WAS with BT broadband - still link to my old bt yahoo a/c , ran XoftSPY SE, the other day, that was result. ----infection in cookies trend micro.
XftSPYSE from ParetoLogic

http://support.paretologic.com/?aid=2&lid=EN&a...

Trial only -finds, won't delete -but tells you where to look.

Edited by Who me ? on Saturday 7th July 20:23

[FourWheelDrift]

So only effected people who had run the Trend Micro online scan?

[ukwill]

Glassman said:

trackcar said:

My bro in law is on BT broadband .. would this affect him?

No. In-laws are exempt.

[Mattt]

ukwill said:

Glassman said:

trackcar said:

My bro in law is on BT broadband .. would this affect him?

No. In-laws are exempt.

Have another from me!

[jagnet]

I prefer using OpenDNS rather than relying on BT's DNS servers - much faster for a start.

[130R]

Bumping this since I have only just found out - This turned out to be BT *illegally* testing Phorm last summer.

http://www.theregister.co.uk/2008/02/27/bt_phorm_1...

Unbelievable.