Help with possible security issue
I had some network problems this morning, and would like to find out what happened. I'm not sure if I have a compromised computer, or if the problem was elsewhere. Observations:
- This morning, most websites weren't loading on my ipad or computer
- https sites wouldn't load, and Google Chrome showed certificate errors: they were signed by 'lolcat'
- Did a tracert and ping to a random site. It resolved to 220.127.116.11 (not the 'correct' ip), which a google search suggests is a sinkhole (not clear on what this means)
- For the tracert, the hostname for every step (except my router) was rdns.gigabell.es
- Logged in to pfsense to check dns settings. i had them set to 18.104.22.168 and 22.214.171.124 (Google dns and Level3)
- I checked the box to 'Allow DNS server list to be overridden by DHCP/PPP on WAN', and everything instantly started to work correctly.
If the Google DNS or Level3 DNS servers were down/hacked I would have expected a news story or something, so I'm concerned I may have a compromised system in my network. Any thoughts on what may have happened? FYI, this occurred at home where I have pfsense serving as the router in a VM.
A quick, general search for 'lolcat' found:
Someone's been playing games with google and Level 3 DNS. not necessarily hacking the servers, but arp spoofing, route injection, or something somewhere.
Do we know who or what this is yet?
Yeah I really expected to see some bigger news on this. Hmm.
Chris makes some good points here: