New DNS trojan taints entire LAN from single box

Internet security experts are warning of a new rash of malware attacks that can hijack the security settings of a wide variety of devices on a local area network, even when they are hardened or don't run on Windows operating systems.

Once activated, the trojan sets up a rogue DHCP, or dynamic host configuration protocol, server on the host machine. From there, other devices using the same LAN are tricked into using a malicious domain name system server, instead of the one set up by the network administrator. The rogue DNS server sends the devices to fraudulent websites that in many cases can be hard to identify as impostors.

more:The Register

Copyright said:

This can be prevented with ample security. No bruteforcer is going to get into my router. My hosts file is read only, and really, what are they going to do if they are able to change my DNS?

A DNS changer 'hijack' will send you to their chosen server ... the computer will then be infected with malware (Bots come to mind here); possibly helping themselves to passwords and critical information on the infected machine. It's not uncommon at all anymore

Copyright said:

This can be prevented with ample security. No bruteforcer is going to get into my router. My hosts file is read only, and really, what are they going to do if they are able to change my DNS?

Well, imagine you type e.g. google.com in the address bar, and instead, it opens 888.com or other malware infecting websites...Even worse, without you knowing, it could just change the DNS to some hidden adv frames and instead of advertisements on the MSN messenger pane, you would have some very nice malicious files saved and doing their nasty job on your machine, probably Bots like Jacee said...

This can be done by assigning you DNS servers which have wrong Name Resolutions.

Although I doubt setting up a whole DHCP server would pass unnoticed...

I had a client's laptop last week with manually assigned DNS entries from malware... pointing to some 83...87..IP address don't remember exactly.

Most likely 85.255.xxx.xx something like that limneos?

Yep.... bad, bad stuff and it isn't getting better.

Sometimes I just want to say, "wipe it all and do a clean install".