DNS Cache Poisoning!

Stary · 20-10-2023 05:51PM #1

Hi,

Never came across this before... I type in a legitimate address in a browser and it shows a completely different website. Tried other browsers and cleared out cookies etc. Even tried from a smart phone and it was the same. I did get a workaroud by manually adding in Googles DNS (8.8.8.8) into the network settings, so could it be that the modem from the ISP has been compromised? With Imagine over LTE FYi. What do you think?

LambshankRedemption · 20-10-2023 08:32PM

https://www.boards.ie/discussion/2058318978/dns-cache-poisoning

Care to share the URL? Even over PM if you prefer?

LambshankRedemption · 20-10-2023 08:35PM

The first thing I would do is check your hosts file. Assuming you are on windows it is located at C:\Windows\System32\etc\hosts. A bit of malware could have dropped in a URL and IP address combination in there to redirect you.

If its not on your PC then it would sound like your ISPs DNS servers have been compromised. Ringing them to tell them or ask them is probably pointless.

Wossack · 20-10-2023 08:44PM

Check your proxy settings haven’t been altered

20-10-2023 08:53PM

Loads of possibilities. Very first thing to check is to open up a console window and type nslookup website.com (with your DNS servers set to default), then nslookup website.com 8.8.8.8, and compare the results. Then ping website.com and make sure the IP is the same

Hijpo · 20-10-2023 11:33PM

https://www.boards.ie/discussion/comment/121264902#Comment_121264902

Said its the same on a phone though so would have to a problem with a device common to other devices.

LambshankRedemption · 21-10-2023 02:44PM

https://www.boards.ie/discussion/comment/121265760#Comment_121265760

I missed the point about the phone. Yeah ok, it's not host specific, so most likely his ISP's DNS server is at fault. Would love to know the URL so I can do some testing myself. OP? As I said, DM me if you dont want to publish the URL.

Stary · 23-10-2023 01:58PM

https://www.boards.ie/discussion/comment/121264902#Comment_121264902

yes, I did check the hosts, but it looks ok i.e. no added commands

Stary · 23-10-2023 02:02PM

https://www.boards.ie/discussion/comment/121264880#Comment_121264880

It was mayogaa.com but redirects to https://finalizer.com/

Explosive_Cornflake · 23-10-2023 02:16PM

Do you know what DNS server imagine are pushing?

It'll be the server section of from nslookup for dig. It'll probably be the LTE router though, which you'll need to log in and check the settings there.

In short, there's nothing to stop the ISP changing the DNS responses, I've seen virgin media do it in some circumstances, e.g. private IP's are sometimes filtered out on public requests. It would be good to get to the bottom of it and see what your DNS server is set to on the internet. I can imagine a situation where your router had an exploit and someone has comprimised it, but that's unlikely, but not impossible.

23-10-2023 02:41PM

Imagine ISP issue / look into your router. That’s where likely the issue lies.

LambshankRedemption · 23-10-2023 03:13PM

https://www.boards.ie/discussion/comment/121274716#Comment_121274716

That is working fine for me. I'll try to look up Imagines DNS server and test with that.

Explosive_Cornflake · 23-10-2023 04:54PM

That's odd, and I don't think it malicous. If it was some banking or crypto sites, I can understand but for those 2, I think hanlon's razor is valid here.

I can think of 2 explanations from tests I ran, but it could be anything.

A badly implemeted 301 at some point in the past on mayogaa.com. This wound't follow your around to devices/private mode/deleting all your cache.
Imagine are caching DNS, and ignoring the 60 second TTL on mayogaa.com. Interestingly enough finalizer.com will reply normally sent the host header for mayogaa.com

If you open mayogaa.com on your phone via imagine you get finalizer.com?

Does this happen via imagine if you open an incognito window?

If yes, do the same tests on mobile data.

Stary · 24-10-2023 08:38AM

https://www.boards.ie/discussion/comment/121275393#Comment_121275393

"If you open mayogaa.com on your phone via imagine you get finalizer.com?" YES

seems like MayoGAA website did have a problem as they were informed of this issue. But even since, the finalizer is still coming up on the phone (PC has manual DNS set, so ok) via Imagine. Going to contact Imagine again to let them know.

Explosive_Cornflake · 24-10-2023 11:05AM

https://www.boards.ie/discussion/comment/121277261#Comment_121277261

What about the 3 other tests?

DNS Cache Poisoning!

Comments