Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites with their own ads. My question is that how the nameservers did it? Did they work as some kind of proxy which intercepted the flow of data, something like ettercap filters? Any links for more study would be appreciated. Thanks.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The DNSChanger trojan had all the sophistication right in the name: it would simply change the DNS server entries on the victims' computers to point to their own rogue DNS servers.

The rogue DNS servers were probably a regular BIND installation providing recursive lookups that was authoritative for zones they found interesting: other advertisers, anti-virus update sites, etc.

share|improve this answer
    
Hmm.. I didn't think of that. Thanks for the answer. –  Wise Sep 16 '12 at 18:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.