pfSense Forum

General Category => General Discussion => Topic started by: agreenfield1 on February 05, 2015, 06:03:23 pm

Title: Help with possible security issue
Post by: agreenfield1 on February 05, 2015, 06:03:23 pm
I had some network problems this morning, and would like to find out what happened.  I'm not sure if I have a compromised computer, or if the problem was elsewhere.  Observations:

 - This morning, most websites weren't loading on my ipad or computer
 - https sites wouldn't load, and Google Chrome showed certificate errors: they were signed by 'lolcat'
 - Did a tracert and ping to a random site.  It resolved to 195.22.26.248 (not the 'correct' ip), which a google search suggests is a sinkhole (not clear on what this means)
 - For the tracert, the hostname for every step (except my router) was rdns.gigabell.es
 - Logged in to pfsense to check dns settings.  i had them set to 8.8.8.8 and 4.2.2.3 (Google dns and Level3)
 - I checked the box to 'Allow DNS server list to be overridden by DHCP/PPP on WAN', and everything instantly started to work correctly.

If the Google DNS or Level3 DNS servers were down/hacked I would have expected a news story or something, so I'm concerned I may have a compromised system in my network.  Any thoughts on what may have happened?  FYI, this occurred at home where I have pfsense serving as the router in a VM.
Title: Re: Help with possible security issue
Post by: Derelict on February 05, 2015, 06:26:39 pm
A quick, general search for 'lolcat' found:

https://forum.pfsense.org/index.php?topic=87491.0

Someone's been playing games with google and Level 3 DNS.  not necessarily hacking the servers, but arp spoofing, route injection, or something somewhere.

Do we know who or what this is yet?
Title: Re: Help with possible security issue
Post by: stephenw10 on February 05, 2015, 08:20:05 pm
Yeah I really expected to see some bigger news on this. Hmm.
Chris makes some good points here:
https://www.reddit.com/r/PFSENSE/comments/2u09v4/hijack_for_people_using_google_dns/

Steve
Title: Re: Help with possible security issue
Post by: doktornotor on February 06, 2015, 02:20:34 am
I'd really drop any forwarding. Unbound + DNSSEC. There's also this 0x20 draft (https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00) - patch for pfSense available here (https://redmine.pfsense.org/issues/4205) until 2.2.1 is out.