DNS poisoning hits one of China's biggest ISPs

[mj]

What I predicted a few weeks back is beginning now. We still don't have reports of black-hat domainers monetizing off the DNS vulnerability, but I believe it's only a matter of time. So far, it only seems to be the botnet operators taking advantage of the ISPs who are slow to upgrade...

"ZDNet's Zero Day blog is reporting that a DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits. The DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer, Adobe Flash Player and Microsoft Snapshot Viewer. In this interview with CNet, Dan Kaminsky confirms that attacks are definitely going on in the field."

http://blogs.zdnet.com/security/?p=1776

.