• August 04, 2020, 04:41:26 AM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Author Topic: DSL 320b (Revision Z1) DNS server exploit  (Read 9548 times)

j0ndgreen

  • Level 1 Member
  • *
  • Posts: 4
DSL 320b (Revision Z1) DNS server exploit
« on: November 25, 2014, 03:56:19 AM »

My DSL modem has been hacked resulting in the DNS servers resolving the majority of web page requests to a URL of the ad shortening service "adfoc.us", which in turn redirects to explicit adult content.

There's no apparent sign of any configuration changes in the modem admin. The DNS settings were set to "Obtain DNS server address automatically". I've now changed these to use Open DNS servers rather than my ISP (PlusNet in the UK). This has improved, though not completely resolved the issue. PlusNet have confirmed this is a security exploit affecting the modem as opposed to it being any issue with their network (or any device on my local network).

Has anyone else experienced this or similar? If so, does anyone know how can it be resolved? The firmware I'm using is v1.05 and the product revision is Z1, though frustratingly, the D-LINK download page for the product is not offering any link for firmware (http://www.dlink.com/uk/en/support/product/dsl-320b-adsl-2-ethernet-modem?revision=deu_revz#downloads). Does anyone know what the latest firmware version is and where it can be downloaded?

Many thanks
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49027
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #1 on: November 25, 2014, 07:17:26 AM »

I recommend that you phone contact your regional D-Link support office and ask for help and information regarding this. We find that phone contact has better immediate results over using email.
Let us know how it goes please.
Logged
"Nothing Funny about It...." We are not here to Impress anyone! You have a be a COMPETENT user first to under stand COMPETENT help!

j0ndgreen

  • Level 1 Member
  • *
  • Posts: 4
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #2 on: November 25, 2014, 10:12:42 AM »

Thanks for the response and advice.

I'd already mailed them before I read this and reset the modem to factory defaults which has fixed the problem. As I've also today ordered a fibre connection from my provider, it's unlikely I'll pursue this any further though I will post back with any response they give via email.
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49027
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #3 on: November 25, 2014, 10:21:57 AM »

Ok, I see there isn't any updates either as I think this is a new product. I recommend phone contacting them in the future if you see any further problems.

Good Luck.
Logged
"Nothing Funny about It...." We are not here to Impress anyone! You have a be a COMPETENT user first to under stand COMPETENT help!

j0ndgreen

  • Level 1 Member
  • *
  • Posts: 4
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #4 on: November 29, 2014, 10:03:19 AM »

They sent me a WeTransfer link (so not publicly accessible) to v1.07 of the firmware with instructions on how to install.

They did not give any comment on the exploit I experienced.
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49027
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #5 on: November 29, 2014, 11:18:00 AM »

Update the FW and let us know how it turns out.
Logged
"Nothing Funny about It...." We are not here to Impress anyone! You have a be a COMPETENT user first to under stand COMPETENT help!

j0ndgreen

  • Level 1 Member
  • *
  • Posts: 4
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #6 on: December 02, 2014, 05:14:07 AM »

It already appeared to be fixed by a prior factory reset. I'm assuming the firmware update (which is now installed) includes protection against that exploit.
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49027
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DSL 320b (Revision Z1) DNS server exploit (RESOLVED)
« Reply #7 on: December 03, 2014, 07:41:19 AM »

Ok, it should work. IF not, update FW using this in the future if you need too:
 FW Update Process

Enjoy.  ;)
Logged
"Nothing Funny about It...." We are not here to Impress anyone! You have a be a COMPETENT user first to under stand COMPETENT help!

Jeromex

  • Level 1 Member
  • *
  • Posts: 6
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #8 on: June 11, 2015, 10:09:01 AM »

I got the same problem with DSL-320B Z1
What can I do ? I
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49027
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #9 on: June 13, 2015, 01:21:59 PM »

What region are you located?
I recommend that you phone contact your regional D-Link support office and ask for help and information regarding this. We find that phone contact has better immediate results over using email.
Let us know how it goes please.


I got the same problem with DSL-320B Z1
What can I do ? I
Logged
"Nothing Funny about It...." We are not here to Impress anyone! You have a be a COMPETENT user first to under stand COMPETENT help!

Jeromex

  • Level 1 Member
  • *
  • Posts: 6
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #10 on: June 20, 2015, 02:39:10 AM »

What region are you located?
I recommend that you phone contact your regional D-Link support office and ask for help and information regarding this. We find that phone contact has better immediate results over using email.
Let us know how it goes please.


Hello, I am located in France.

I believe having solved the problem though. But with a doubt.
I do not agree with the begining of this topic, the author resetting the modem is a bad idea.
On the contrary I think the problem is the default setting on accepting some incoming WAN requests. I disabled this but strangely the Wan settings page don't appear again.
So now I am stealth according GRC ShiedsUp Tests as before with my ancient USB ADSL modem, and with a permanent open D-LinK Status Page I can control the problem is fixed, unless temporarily.
I got non infection in that period in what is possible to detect now.


Logged

Jeromex

  • Level 1 Member
  • *
  • Posts: 6
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #11 on: June 20, 2015, 02:43:25 AM »

I add that I also put the 2 DNS of my FAI in the DNS settings on the modem and on Windows, because the prescriptions of D-link (put as DNS only one local network adress) is bad viewed by the GRC  DNSCheck.
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49027
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: DSL 320b (Revision Z1) DNS server exploit
« Reply #12 on: June 22, 2015, 07:21:26 AM »

I recommend that you phone contact your regional D-Link support office and ask for help and information regarding this. We find that phone contact has better immediate results over using email.
Let us know how it goes please.
Logged
"Nothing Funny about It...." We are not here to Impress anyone! You have a be a COMPETENT user first to under stand COMPETENT help!