A rural wireless ISP configures all their customers equipment to point to their own nameservers. For the past 2 months or so their primary name server has intermittently been serving malicious responses for common domains(that i have tested) - like google.
Upon inspection, they appear to be running windows 2K for dns services. The server also appears to be open to answer external queries. I have notified their systems admin initially 2 months ago when first detecting this behavior.
Since this issue has sneakily persisted for the past 2 months and there has been no public acknowledgment or corrective action taken, at what point does an ISP become liable?
Is there not any kind of expectations for ISPs in these kind of situations?
In my eyes running ancient software and allowing an issue that could potentially be devastating to the user's of their DNS services, is at best Bad Manners...
Lastly, how should I move forward from here? Do I expose my findings to their customers? Do I draft an official report of my findings and deliver in person? Do nothing because this is common place? Or..?