RE: DNS CACHE POISONING? - Our Portal is redirecting to our first competition

["Boaz Shunami" <BoazS () comsecglobal com>]

Hi

Some questions you need to ask yourself.

Maybe one of the proxy servers got poisoned and not the DNS server?

Maybe it's a HTTP Response Splitting attack?

We have seen a similar issue awhile ago and it was caused by a mistake of a developer and not by malicious activity...

Is it from several different locations or from a single location? Try to reach your site using web proxies and see if 
you still get the same problem so you know for sure the problem is on your servers.

Do you have any substantial evidence as to who has done it?

Best Regards,

Boaz Shunami

Comsec Consulting

-----Original Message-----
From: ponchovaldes () gmail com [mailto:ponchovaldes () gmail com] 
Sent: Tuesday, January 22, 2008 2:56 AM
To: incidents () securityfocus com
Subject: eSafe quarantine: DNS CACHE POISONING? - Our Portal is redirecting to our first competition

Hello guys, we have a social network that is getting stronger, but we are having an issue.



And the issue is that Sometimes... our page redirects to another Portal, actually the page that redirects is our first 
competition,here in Latino America, i know that they are causing that kind of mess.. so we thought in this.



- We know that our DNS server is ok, and havent been compromised,

- DNS cache poisoning

- Malware ?

- some kind of virus that the guys(bad) made. ( the other portal - social network-)



- Other soolution? sue them?



HElp guys.. this thing is taking out alot of users :(



thanks in advance!



Cheers from México
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************