Help with possible security issue



  • I had some network problems this morning, and would like to find out what happened.  I'm not sure if I have a compromised computer, or if the problem was elsewhere.  Observations:

    • This morning, most websites weren't loading on my ipad or computer
    • https sites wouldn't load, and Google Chrome showed certificate errors: they were signed by 'lolcat'
    • Did a tracert and ping to a random site.  It resolved to 195.22.26.248 (not the 'correct' ip), which a google search suggests is a sinkhole (not clear on what this means)
    • For the tracert, the hostname for every step (except my router) was rdns.gigabell.es
    • Logged in to pfsense to check dns settings.  i had them set to 8.8.8.8 and 4.2.2.3 (Google dns and Level3)
    • I checked the box to 'Allow DNS server list to be overridden by DHCP/PPP on WAN', and everything instantly started to work correctly.

    If the Google DNS or Level3 DNS servers were down/hacked I would have expected a news story or something, so I'm concerned I may have a compromised system in my network.  Any thoughts on what may have happened?  FYI, this occurred at home where I have pfsense serving as the router in a VM.


  • Netgate

    A quick, general search for 'lolcat' found:

    https://forum.pfsense.org/index.php?topic=87491.0

    Someone's been playing games with google and Level 3 DNS.  not necessarily hacking the servers, but arp spoofing, route injection, or something somewhere.

    Do we know who or what this is yet?


  • Netgate Administrator

    Yeah I really expected to see some bigger news on this. Hmm.
    Chris makes some good points here:
    https://www.reddit.com/r/PFSENSE/comments/2u09v4/hijack_for_people_using_google_dns/

    Steve


  • Banned

    I'd really drop any forwarding. Unbound + DNSSEC. There's also this 0x20 draft - patch for pfSense available here until 2.2.1 is out.