Redbricks Intranet Collective (RIC)

A new malware attack is going around the Internet where by an infected computer on the estate could persuade other computers on the estate to use a rogue DNS (domain name system) server, rather than RIC's DNS server.

If this happens to your computer you could have an instance where you think you're going to your bank's web site but instead you've gone to a fake version of their site and have your username and password stolen.
Or your Windows operating system could think it's downloading and installing updates from Microsoft but instead it's downloading and installing viruses from a rogue site pretending to be microsoft.com.

A fix on our firewall to prevent this attack has been put in place today so that if your computer does get given a rogue DNS address by an infected computer, then your computer is prevented from using the rogue DNS server.

An implication of this is that if you have your computer set to use a DNS server out on the Internet, rather than the RIC DNS server at 192.168.1.3, then your Internet access will now likely fail. You should have your operating system set to get its IP and DNS addresses automatically, in which case it'll get given a DNS server address of 192.168.1.3.

Further information:
http://blog.pfsense.org/?p=308
http://www.symantec.com/security_response/writeup.jsp?docid=2008-120318-...