I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites with their own ads. My question is that how the nameservers did it? Did they work as some kind of proxy which intercepted the flow of data, something like ettercap filters? Any links for more study would be appreciated. Thanks.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
The DNSChanger trojan had all the sophistication right in the name: it would simply change the DNS server entries on the victims' computers to point to their own rogue DNS servers. The rogue DNS servers were probably a regular BIND installation providing recursive lookups that was authoritative for zones they found interesting: other advertisers, anti-virus update sites, etc. |
|||
|
|
