What might be the reason for an major antivirus software to not detect an malicious DNS entry?

Question

I recently installed the trial version of Kaspersky as I had always a good impression of the features of their software. I also bought a 1 PC 1 year license, but didn't unsealed it yet as something very unsatisfying happened to me.

When I was on a LAN gaming party and tried to use the network just a fractal of web services was accessible by domain-name for me. After some research and with help of others, we figured out this was due some suspicious entry as my primary DNS-server IP and that server was probably developed without considering the scenario, that was present on the LAN, as legit DNS had handled it.

After googling the IP which was set as my DNS server, almost any page was alerting about MITM attacks and trojan malware. And even the first post was a report in Kaspersky's tracker from back to 2012.

So here is my question:

How can it be, that a major anti male software like Kaspersky has been informed about this 4 years ago and still isn't able to track this?

From my understanding this should be a easy one to detect. I guess the most basic thing to do is add this IP-address to some blacklist and just check the DNS entry against the blacklist. Also figuring out how to read the systems DNS entry shouldn't be that much of a deal for devs of such a company, should it?

So, what might be reasons for Kaspersky not being able to track this, except simply lumpyness of the corresponding dev?

Note: I'm legit interested in this. I'm not trying to rant. If this might appear so, one can feel free to replace the product name with a pseudoproductname.

Answer 1

When checking quickly, I saw several instances of the exact opposite issue: Kaspersky blocking any connection to user's router's IP.

The most probable explanation is that Kaspersky actually blocks known malicious IPs (given that you use the right product, ie. at least Kaspersky Internet Security and no the standalone anti-virus), but with two main prerequisites:

• The malicious IPs must be known: it must have been confirmed as malicious by Kaspersky teams, added in a blacklist and your software must have updated this blacklist, however chances are that the attacker will change the IPs they use regularly,
• The malicious IP must indeed be malicious:
  • Often this is just a shared or compromised host which is also serving legitimate contents, completely blocking the IP could have unwanted side-effect. To give a concrete example there are poor-quality blacklists on the Internet which are regularly blocking major CDNs like Cloudfare because their IPs have been used to serve some malware. Once such blacklist is applied it becomes impossible to access any website relying on Cloudflare services...
  • Or the malware is exploiting some legal grey area.

Following your comments, in your case, this seems to be this latter case.

You seem to be affected by the DNS Unlocker software, a company advertising on their website (http://www.dnsunlocker.com, URL voluntary made not clickable) a service allowing to bypass geo-restricted contents but proposing no download to actually install their software (!).

They explicitly explain that they achieve so by replacing the standard DNS server by their own one which will replace the answers for filtered websites. They show a clear Terms and Privacy statements, provide detailed and complete uninstallation instruction (including the fact that the DNS configuration will have to be modified manually), inform that their application is ad-supported and provide a contact form.

They also seem related to GreenTeam (http://www.greentm.co.uk, honest enough to announce in their "About Us" page that they are located in Israel and not the UK...), formerly CloudGuard as per my understanding, which rely on the very same system to filter malicious websites (à la OpenDNS then, but with injected ads and content...).

Should an anti-virus block such kind of "grey area" services? The question is quite difficult, since we are mostly talking here about the balance between freedom and security. That's why for the same software, as long as it is not proven that a service does anything really illegal and harmful, some anti-virus may classify it as malware as other may take a more conservative approach.

Sadly, none of them seem to ask for the user's opinion, assuming that the user doesn't know and prefer not being asked to decide anything.