Internet Identity

In mid-April, unidentified criminals poisoned the DNS servers operated by NET Virtua, a Brazilian ISP that serves 1.4 million customers. Several high value domains, including domains belonging to Google and to a major Brazilan bank, were poisoned. When DNS is poisoned, visitors attempting to navigate to a website using the legitimate URL are unwittingly redirected to a mailicious website instead. NET Virtua reported that at least 14,000 of its customers were exposed to the poisoned DNS information.

The main domain for Bradesco, one of Brazil's largest financial institutions, was poisoned. As a result, visitors looking for the Bradesco site were instead redirected to a malicious web site, apparently hosted in South Korea, that spoofed the look and feel of the real Bradesco site in an attempt to steal users' login credentials and other personal information.

The criminals also poisoned the domain for Google AdSense in Brazil and redirected it to a site that attempted to download malware onto a visitor's computer. Since that AdSense domain is used by any site that presents Google's Brazilian ads, those sites were effectively turned into distribution points for the malware.