Help with possible security issue

  • I had some network problems this morning, and would like to find out what happened.  I'm not sure if I have a compromised computer, or if the problem was elsewhere.  Observations:

    • This morning, most websites weren't loading on my ipad or computer
    • https sites wouldn't load, and Google Chrome showed certificate errors: they were signed by 'lolcat'
    • Did a tracert and ping to a random site.  It resolved to (not the 'correct' ip), which a google search suggests is a sinkhole (not clear on what this means)
    • For the tracert, the hostname for every step (except my router) was
    • Logged in to pfsense to check dns settings.  i had them set to and (Google dns and Level3)
    • I checked the box to 'Allow DNS server list to be overridden by DHCP/PPP on WAN', and everything instantly started to work correctly.

    If the Google DNS or Level3 DNS servers were down/hacked I would have expected a news story or something, so I'm concerned I may have a compromised system in my network.  Any thoughts on what may have happened?  FYI, this occurred at home where I have pfsense serving as the router in a VM.

  • LAYER 8 Netgate

    A quick, general search for 'lolcat' found:

    Someone's been playing games with google and Level 3 DNS.  not necessarily hacking the servers, but arp spoofing, route injection, or something somewhere.

    Do we know who or what this is yet?

  • Netgate Administrator

    Yeah I really expected to see some bigger news on this. Hmm.
    Chris makes some good points here:


  • Banned

    I'd really drop any forwarding. Unbound + DNSSEC. There's also this 0x20 draft - patch for pfSense available here until 2.2.1 is out.

Log in to reply