The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    DNS/Cookie hijacking

    Discussion in 'Networking and Wireless' started by Mobius 1, Sep 22, 2013.

  1. Mobius 1

    Mobius 1 Notebook Nobel Laureate

    Reputations:
    3,447
    Messages:
    9,069
    Likes Received:
    6,376
    Trophy Points:
    681
    I have this issue again after a similar problem has been fixed: http://forum.notebookreview.com/windows-os-software/722534-browser-virus-redirect-isp.html

    Now it happens on firefox and after a restart and flushing+renew ipconfig it doesn't work

    TDSS/Antirootkit standalone detects nothing


    Firefox V23/Win7 x64

    -Pinging website works
    -Can be opened in Chrome/IE9
    -IPV4 DNS config locked on google 8.8.8.8/8.8.4.4
    -Windows Defender detects no threats
     
    Mobius 1, Sep 22, 2013
    #1
  2. ajnindlo

    ajnindlo Notebook Deity

    Reputations:
    265
    Messages:
    1,357
    Likes Received:
    87
    Trophy Points:
    66
    ajnindlo, Sep 23, 2013
    #2
  3. Jarhead

    Jarhead 恋の♡アカサタナ

    Reputations:
    5,036
    Messages:
    12,168
    Likes Received:
    3,134
    Trophy Points:
    681
    Definitely check out the host file first to see if there's anything in there. Ideally, there shouldn't be any entries in there, except maybe 127.0.0.1 (loopback).
     
    Jarhead, Sep 23, 2013
    #3
  4. Mobius 1

    Mobius 1 Notebook Nobel Laureate

    Reputations:
    3,447
    Messages:
    9,069
    Likes Received:
    6,376
    Trophy Points:
    681
    Host file seems clean.

    I also tried disabling/reenabling network adapter, seem to have no effect :|
     
    Mobius 1, Sep 24, 2013
    #4
  5. Aluminum

    Aluminum Notebook Consultant

    Reputations:
    44
    Messages:
    238
    Likes Received:
    2
    Trophy Points:
    31
    If you really think someone upstream (like your ISP) is doing this, there is not much you can do about it. DNS is unencrypted and modifying packets on the wire is trivial, there is even dedicated hardware to do this in realtime with no speed penalty for most major protocols.

    The only real way around it would be a VPN to hardcoded ips, assuming they don't block the ports (or you can pick a common open port on both ends) and/or hope they don't use some kind of packet inspection to drop tunnels. (if they paid for the injection hardware, odds are they will block simple SSL vpns too)

    I would not surprise me at all for a cell carrier to do this with the usual excuse of bandwidth/service management, they also want to do things like force proxy use etc.
     
    Aluminum, Sep 24, 2013
    #5
  6. Mobius 1

    Mobius 1 Notebook Nobel Laureate

    Reputations:
    3,447
    Messages:
    9,069
    Likes Received:
    6,376
    Trophy Points:
    681
    Tried HSS VPN, does not work w/ normal - private browsing

    Tried PPTP and OpenVPN, same result
     
    Mobius 1, Sep 25, 2013
    #6