A rural wireless ISP configures all their customers equipment to point to their own nameservers. For the past 2 months or so their primary name server has intermittently been serving malicious responses for common domains(that i have tested) - like google.

Upon inspection, they appear to be running windows 2K for dns services. The server also appears to be open to answer external queries. I have notified their systems admin initially 2 months ago when first detecting this behavior.


Since this issue has sneakily persisted for the past 2 months and there has been no public acknowledgment or corrective action taken, at what point does an ISP become liable?

Is there not any kind of expectations for ISPs in these kind of situations?

In my eyes running ancient software and allowing an issue that could potentially be devastating to the user's of their DNS services, is at best Bad Manners...

Lastly, how should I move forward from here? Do I expose my findings to their customers? Do I draft an official report of my findings and deliver in person? Do nothing because this is common place? Or..?

closed as off-topic by Xander, Rory Alsop Aug 18 '15 at 7:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Out of curiosity, are they restricting you from configuring on your own devices? What kind of malicious responses are they serving that wouldn't be caught by tls? – David Zech Aug 17 '15 at 19:13
  • Can you change the DNS server on your equipment? Can you change ISPs? Is there a media outlet in your area that might use the same ISP? – schroeder Aug 17 '15 at 19:17
  • @Nighthawk441 They are not restricting customer devices to their nameservers. They are however configuring customer's devices to use their nameservers during installation - with no comment on the affects or the option of using any nameservers a customer wants. The responses have spoofed certificates from "lolcat" and are for IPs that show up in spam/malware lists. – N.Balauro Aug 17 '15 at 19:29
  • 3
    This is a legal question that is specific to your location, not an infosec question per the help page. – Neil Smithline Aug 17 '15 at 20:19
  • 1
    As Neil says this is a legal question. Common sense says they become liable "when damage is done" but laws can vary. There is no right answer here because full disclosure / name and shame puts the users at more risk, as does the servers continuing to remain in this state with nothing done about it. I recommend contacting the abuse address that they're required to maintain instead, since that team is more likely to have direct ties to that company's legal department. – Andrew B Aug 17 '15 at 21:57

Set up your own DNS recursive resolver with DNSSEC and set an outgoing firewall policy blocking DNS requests to anything else. ISPs tend to abuse DNS, you don't want to use their servers, even if they are configured correctly.

  • 2
    I'm not sure this answers the question. – schroeder Aug 17 '15 at 20:49
  • I was answering the very last one, namely 'Or..?' You won't achieve much via legal system; however, you can make your network more secure without much difficulty and no human involvement. – Oleg Mazurov Aug 17 '15 at 20:56
  • If you are really worried use dnscrypt also – Freedo Aug 17 '15 at 23:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.