6

If I go to a web address that doesn't exist such as http://testestewcsdijncijfkdmkdfkddmkmdmdsexsecsecfvrgtoejwfej.com/ I get landed on a strange Chinese page like this:

enter image description here

This happens for all web browsers. Why does this happen? Is this something installed on my computer (malware?) or is it something my ISP does?

Extra info in response to comments/answers:

(I don't really know much about networking so I don't know what much of this means)

/etc/hosts:

127.0.0.1   localhost
127.0.1.1   $COMPUTER_NAME

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

where $COMPUTER_NAME is my actual computer name.

/etc/resolv.conf:

# Generated by NetworkManager
domain 520b.com
search 520b.com
nameserver 192.168.1.1

Output of dig siadfiosjdfosjdfsifjs.co.nz:

; <<>> DiG 9.7.3 <<>> siadfiosjdfosjdfsifjs.co.nz
;; global options: +cmd
;; connection timed out; no servers could be reached
1
  • Do check your /etc/hosts file, maybe you're the first victim of malware on Ubuntu (first I ever heard of anyway). But I bet it's the DNS, some of them are not ashamed to do this kind of thing Jun 21, 2011 at 10:40

4 Answers 4

7

This can be caused by a few things:

  • A DNS server is injecting false responses (try setting your DNS to 8.8.8.8, Google's server)

  • A proxy at your ISP (that'd be quite weird, almost malicious)

  • Your router injecting false DNS responses

That's all I can think of now. I would bet it's not caused by any Ubuntu software.

You can check your DNS provider's integrity by typing this into a Terminal:

dig siadfiosjdfosjdfsifjs.co.nz | grep ANSWER

The result should say ANSWER: 0.

6
  • 2
    Changing the DNS to 8.8.8.8 and rebooting fixed this.
    – dv3500ea
    Jun 21, 2011 at 11:41
  • @dv3500ea, now you're under Google's evil control! Don't get me wrong though, I love Google's services.
    – Oxwivi
    Jun 21, 2011 at 12:07
  • 2
    It's a paid service of course. The currency is 'information', and the product is a DNS server that answers in 8 milliseconds. Tough I do sometimes feel more like the "product" than the "customer" ;-) Jun 21, 2011 at 12:11
  • 1
    If you are not fine with Google, use 208.67.222.222, 208.67.220.220 for OpenDNS. It's possible they'll have lower latency in UK.
    – jnv
    Jun 21, 2011 at 12:17
  • @jnv they do a similar thing, they return false results pointing towards advertisement pages for unknown names. You can check this via dig @208.67.222.222 siadfiosjdfosjdfsifjs.co.nz (check the "ANSWER SECTION") Jun 21, 2011 at 12:18
3

OpenDNS does something similar for their free service (redirect to an ad page). Since it works with any "bad" address, its most likely a DNS redirect on your providers side. Its a pretty sleazy thing to do (sell advertisement space for bad address requests) but not unheard of. Check /etc/resolv.conf to make sure someone hasn't hijacked your computer by changing your dns settings however.

If your resolv.conf points to your official ISP DNS server or to your router then to double check that your ISP is indeed responsible to do so - open /etc/resolv.conf in your favorite text editor (under sudo because its a system file) comment out the lines in the file (comment out with a hash #) and type in nameserver 4.2.2.1 which is a known good top layer dns server.

If that doesn't fix the issue - do other computers on the same network exhibit the same problem?

EDIT

Based on your comment it seems that your resolv.conf was modified - this line in particular

search 520b.com

which goes to a suspiciously similar website to the one in your OP.

There are two distinct possibilities here - either your computer was compromised or your router. I would check your router settings to see if someone has modified the dns settings on it, since your computer (most likely) obtains dns/routing information automagically via dhcp any bad configuration on the router side will propogate to your computer. There is also a remote possibility of ISP mischief - who is your ISP?

Since DHCP clears resolv.conf every time it obtains a new address there is little chance that your PC is compromised if you are using DHCP (As it would reset every reboot at least and assuming that your router is clean), if - however- you are using a static configuration someone/something may hae altered your resolv.conf file in the past and it has stayed there since.

6
  • My ISP is TalkTalk which is a very popular mainstream ISP in the UK. I followed this to change my DNS to 8.8.8.8 and now /etc/resolv.conf only has nameserver 8.8.8.8.
    – dv3500ea
    Jun 21, 2011 at 11:45
  • @dv3500ea while that solves the immediate problem it doesn't answer the question of how this got on your computer in the first place - worst case is that your computer or router has been compromised.
    – crasic
    Jun 21, 2011 at 11:48
  • I agree, you should at least call up your ISP. It'll probably be a waste of your time of course. Don't we have some sort of law against this now? (or an EU directive) Jun 21, 2011 at 12:04
  • @Stefano before calling the ISP he should verify that it isn't some 3d party. Its not very likely that a British ISP would be forwarding traffic to a Chinese search site even if they are trying to be sleazy.
    – crasic
    Jun 21, 2011 at 12:08
  • Good point, I forgot it was a Chinese page for a second there Jun 21, 2011 at 12:10
3

My ISP is TalkTalk. I was using the default setup of my router and connecting to it wirelessly using automatic DHCP. This was what my router configuration and my connection looked like (router config page is at http://192.168.1.1/):

router + connection

So my computer used the DNS of 192.168.1.1 which used the router DNS of 62.24.243.1 (primary) and 62.24.243.2 (secondary). This redirected me to a page that seems to be from 520b.com (not linking directly because I don't want to reward them!).

When I changed the DNS for my computer to 8.8.8.8 and rebooted, this problem disappeared and instead I got the expected result of my web browser telling me it couldn't find the page.

I wanted to test if my router had been modified to cause this so I used the router configuration to reboot the router to factory settings. I also set my computer to use the router DNS again. After this, the problem was present again. The factory settings for the router use 62.24.243.1 (primary) and 62.24.243.2 (secondary) for DNS. Therefore, the problem was the default DNS that TalkTalk uses.

This is certainly dodgy but it could be that TalkTalk doesn't own the DNS and they themselves are being screwed. Either that or TalkTalk is evil.

Anyway, my long term solution is to set the router to use Google's DNS (8.8.8.8 primary and 8.8.4.4 secondary). I can get to this by clicking 'Advanced', clicking ok on a patronising dialog: well duh and navigating to Basic->DHCP. I then entered the IP addresses into the correct boxes then clicked a submit button. After this I rebooted my router and computer and everything was fine.

3
  • 3
    Excellent write-up, here! I would suggest, as your next step, contacting TalkTalk's technical support -- it's entirely possible that they have been compromised, and they may not even know it! It's certainly common (unfortunately) for DNS providers at all levels to offer up advertising pages on non-existent domains, but even so it's quite suspicious for a UK-based ISP to offer a Chinese page...
    – Kromey
    Jun 21, 2011 at 16:27
  • 1
    Who's the manufacturer of the router? Jun 22, 2011 at 11:22
  • It's a Huawei EchoLife HG520b.
    – dv3500ea
    Jun 22, 2011 at 18:49
0

Worth looking at the famous 'my server has been hacked' post on ServerFault or Security Stack Exchange for guidance as if your PC was compromised then you could still be at risk.

This could include having a keylogger stealing your passwords and online account details, being part of a botnet, or worse.

3
  • would you agree that this is very unlikely? (I still didn't managed to find any good numbers on this, but I've yet to see any news story about a botnet with linux-clients in it) Jun 21, 2011 at 12:07
  • Yes, it is unlikely - but it is always worth looking at the worst case and working downwards from there. It is definitely possible to create linux botnets (in fact I know of various folks at universities who co-opted CPU time to work on the distributed.net rc-5 client back in the day)
    – Rory Alsop
    Jun 21, 2011 at 13:00
  • 1
    @Stefano What is more likely is that the router was compromised. Since ISP's send out routers to clients en masse and people rarely upgrade router firmware, exploits are both long lasting and very fruitful.
    – crasic
    Jun 26, 2011 at 22:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .