Проверено. у нас мин нет!

Posted on by

Two days ago Yandex.ru listed hexacorn.com as malicious.

It was the only URL checker that highlighted it as malicious, but being on such list is always a serious concern:

 

I checked the web site, compared with the older backups and I didn’t see anything wrong. I then dropped Yandex.ru guys an email, and looks like they fixed their listing  – testing with VirusTotal shows it is all good now:

Not sure what caused this, but well… it’s all about heuristics and they are sometimes wrong.

Good to see Yandex.ru guys reacted so quickly.

Thanks!

And just in case you are wondering what the title means, this should provide you a context:

 


And no, I am not suggesting there were any mines on Hexacorn. Like everything, context has its scope and err… context 🙂

Image sources:

http://www.gazeta.lv/photos/5/Mina_4.jpg

http://www.gazeta.lv/photos/5/Mina_3.jpg

http://www.gazeta.lv/photos/5/Mina_8.jpg

Wasted Human cycle a.k.a. How dns-ok.us, dns-ok.de, etc. work

Posted on by

I came across these web sites while reading news about dnschanger and shutting down the DNS servers that used to be controlled by it. I was curious how it works, so decided to figure it out. Previously (for Conficker for example) this sort of pages just included IFRAMEs pointing to web addresses that were known to be blocked by modified hosts files, e.g. pages of AV companies. If any of these were blocked, you would know there is something going on with your system.

In this case it’s different. the page is static and just shows either in

GREEN

or

RED


I guessed it may be a change in DNS resolution that is different depending on your DNS settings – if the request goes through the ‘bad guy’, the server will return the ip for the red page, if your settings are good, it will return the green page.

Indeed, this is the case and you can confirm it via nslookup.

nslookup dns-ok.us
Name: dns-ok.us
Address: 38.68.193.96

nslookup dns-ok.us 77.67.83.1  <– 77.67.83.1 is a ‘bad guy’ DNS
Name: dns-ok.us
Address: 38.68.193.97

Check

 

Not a rocket science.

When I found out, I googled for IPs and lo and behold, I immediately spotted a comment from a guy using nick ‘TEA-Time’ talking about it few weeks back on Brian Krebs’ blog: https://krebsonsecurity.com/2012/02/half-of-fortune-500s-us-govt-still-infected-with-dnschanger-trojan/

Argh.

Here goes yet another wasted human cycle.

So this post is for you not to waste yours 🙂