2

I recently installed the trial version of Kaspersky as I had always a good impression of the features of their software. I also bought a 1 PC 1 year license, but didn't unsealed it yet as something very unsatisfying happened to me.

When I was on a LAN gaming party and tried to use the network just a fractal of web services was accessible by domain-name for me. After some research and with help of others, we figured out this was due some suspicious entry as my primary DNS-server IP and that server was probably developed without considering the scenario, that was present on the LAN, as legit DNS had handled it.

After googling the IP which was set as my DNS server, almost any page was alerting about MITM attacks and trojan malware. And even the first post was a report in Kaspersky's tracker from back to 2012.

So here is my question:

How can it be, that a major anti male software like Kaspersky has been informed about this 4 years ago and still isn't able to track this?

From my understanding this should be a easy one to detect. I guess the most basic thing to do is add this IP-address to some blacklist and just check the DNS entry against the blacklist. Also figuring out how to read the systems DNS entry shouldn't be that much of a deal for devs of such a company, should it?

So, what might be reasons for Kaspersky not being able to track this, except simply lumpyness of the corresponding dev?

Note: I'm legit interested in this. I'm not trying to rant. If this might appear so, one can feel free to replace the product name with a pseudoproductname.

  • Was it a global or local IP address? Could provide the first two bytes? – WhiteWinterWolf Jun 24 '16 at 10:26
  • @WhiteWinterWolf: It was a global one. When I'm back home I could even edit it into my post if it is important/allowed/usefull. – Zaibis Jun 24 '16 at 10:28
1

When checking quickly, I saw several instances of the exact opposite issue: Kaspersky blocking any connection to user's router's IP.

The most probable explanation is that Kaspersky actually blocks known malicious IPs (given that you use the right product, ie. at least Kaspersky Internet Security and no the standalone anti-virus), but with two main prerequisites:

  • The malicious IPs must be known: it must have been confirmed as malicious by Kaspersky teams, added in a blacklist and your software must have updated this blacklist, however chances are that the attacker will change the IPs they use regularly,
  • The malicious IP must indeed be malicious:
    • Often this is just a shared or compromised host which is also serving legitimate contents, completely blocking the IP could have unwanted side-effect. To give a concrete example there are poor-quality blacklists on the Internet which are regularly blocking major CDNs like Cloudfare because their IPs have been used to serve some malware. Once such blacklist is applied it becomes impossible to access any website relying on Cloudflare services...
    • Or the malware is exploiting some legal grey area.

Following your comments, in your case, this seems to be this latter case.

You seem to be affected by the DNS Unlocker software, a company advertising on their website (http://www.dnsunlocker.com, URL voluntary made not clickable) a service allowing to bypass geo-restricted contents but proposing no download to actually install their software (!).

They explicitly explain that they achieve so by replacing the standard DNS server by their own one which will replace the answers for filtered websites. They show a clear Terms and Privacy statements, provide detailed and complete uninstallation instruction (including the fact that the DNS configuration will have to be modified manually), inform that their application is ad-supported and provide a contact form.

They also seem related to GreenTeam (http://www.greentm.co.uk, honest enough to announce in their "About Us" page that they are located in Israel and not the UK...), formerly CloudGuard as per my understanding, which rely on the very same system to filter malicious websites (à la OpenDNS then, but with injected ads and content...).

Should an anti-virus block such kind of "grey area" services? The question is quite difficult, since we are mostly talking here about the balance between freedom and security. That's why for the same software, as long as it is not proven that a service does anything really illegal and harmful, some anti-virus may classify it as malware as other may take a more conservative approach.

Sadly, none of them seem to ask for the user's opinion, assuming that the user doesn't know and prefer not being asked to decide anything.

  • As I told I didn't use my license yet. What I used was just what I got when I went to kaspersky site and hit "get trial". So it could just have been the standaloen anti virus. But what antivirus standalone would be for if not even detecting the trojan? Shouldn't they at least tell me they detected something and offer to remove it by upgrading my license? also as I told, this IP wasn't changed for 4 years now. and also completly denying by this blacklist wouldn't be required just denying DNS from it would be enough, wouldn't it? Or could even this run into false "positives"? – Zaibis Jun 24 '16 at 10:57
  • Well I'm close to the guy who set up the network, and we encoutnered the issue before the visitors where joining. also It was only me having this. Also the report of the DNS IP was reported to be used to smuggle in trojans. trojans which kaspersky didn't find but later on another antivirus I tryed was able to spot. So even if the other software was wrong about conecting the trojan to the wrong DNS, what was also what I figured out, its still the trojan, which Kaspersky wasn't able to spot, while it seems to be known it is a trojan beeing known for comming from/through mentioned DNS. – Zaibis Jun 24 '16 at 11:16
  • It was 82.163.143.171 – Zaibis Jun 24 '16 at 14:22
  • And yeah, obvisious in whos favor this goes. the other tool detected 7 threats and 2 trojans while kaspersk told me I'm safe. But anyway I'm interested how Kaspersky could fail that hard. until that day I was pretty satisfyed by what kaspersky was doing. – Zaibis Jun 24 '16 at 14:25
  • @Zaibis: Thanks for IP, it was very informative and I've update my answer accordingly! – WhiteWinterWolf Jun 24 '16 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.