Prologue: I am well aware that this topic will lend itself to angry ranting. As this is GQ, please try to restrain yourself until we’ve answered the question at hand. Once that’s been accomplished, I will request that the thread be moved to the Pit so that spleen may be fully and justifiably vented at the unlubricated corpsefuckers who screwed up my PC (and many other things as well). Thanks in advance for your understanding.
So here’s the scoop.
I come in to work this morning and log onto my machine per the normal routine. Right away I notice that it’s extremely slow; it takes several minutes to get from the logon to a functional desktop. I’m assuming there’s some sort of network latency, as sometimes happens, and that when I finally get into email I’ll find an announcement from the gurus explaining what’s going on.
But no, there’s no announcement. And what’s worse, I can’t touch any of my company’s internal web servers. Not the intranet, not the web apps for batch job management or trouble ticket administration, or anything. Instead, I get a generic-looking message about an “internet server” and “cannot validate name.” My co-worker is not having the same problem. Something about it tickles the back of my mind, but I can’t put a finger on it.
I fire up a command window and try pinging and tracerting the web servers. Instead of the expected path, I get the bottom-most value from my TCP/IP “append suffix” config panel, plus an oddball IP address: 64.94.110.11. Again, I get a tickle, but I can’t place it.
So I go into my network properties and check out the local area TCP/IP settings, and I find that the default, “obtain DNS server address automatically,” has been switched to “use the following” with another oddball address in the “preferred” box. I doublecheck it in the command window with an ipconfig/all, and sure enough, my DNS server value is pointed outside the network instead of where it’s supposed to be, at my company’s internal DNS library. I have no idea how this happened; I certainly didn’t change it.
So I correct the TCP/IP settings, and I do an ipconfig/release and /renew, and like magic, I’m back in business. But I’m still getting that nagging tickle, so I’m off to Google to see if there’s any information on this mysterious 64.94.110.11 value.
And: Oh, right, it’s that. The short version: VeriSign has tweaked name resolution protocols on the web in order to route unknown names to its own site as a means of self-promotion.
The mystery, though, is how my TCP/IP settings got changed. I run my full suite of hack-detection tools; the only thing that comes up is in SpyBot, which identifies a “data source object exploit” located in “internet settings\zones.” There isn’t any additional information available, but it sounds like it might be connected, so I kill it to be on the safe side. Now I just have to eyeball my computer every time I turn it on for the next few days to make sure there isn’t some sort of registry hack hiding somewhere that’s designed to change the settings back to the incorrect values.
I know I didn’t do anything dangerous to expose myself to an obvious hack. I don’t open unusual attachments; I don’t visit websites outside the trusted mainstream; I’m quite scrupulous about immediately enabling and installing all the security patches and virus packs that get pushed to my workstation by our network admins. And yet, somehow, my TCP/IP settings were monkeyed with, and my company web servers were temporarily lost to me as a result.
That’s my question: How?
P.S. Just to repeat, please save your vitriol for the shitsniffers at VeriSign until the question has been fully answered and this thread moved to the Pit. Then you can plow them a new anal fissure to your heart’s content. But not until then, please. Thanks.
