Intruder alert: Red spy is in the base

Another story from my days as a network admin in a students' dormitory.

Short description: Network consisted of ~500 clients with no managed switches at that point (which we later replaced). Since trying to lock stuff down was quite pointless in such a BYOD environment, we tried to log shenanigans on the router and otherwise were forced to hope that noone did anything too stupid.

Which meant that you simply connected your computer to the network and then simply registered yourself. You then got a static IP adress from our internal network, connected to the MAC of your NIC.

Usually worked quite well.

_________________________

Until the day that one of my (technologically literate!) neighbours came knocking on my door: "Hey, Internet access is down."

Weird. I was browsing the net at the moment and all was fine on my end. SSH'ed into the router - no problems there. nmap also reported a number of clients in our dorm's adress space.

Oh, well, let's have a look at the source. Powered my PC down and went over to my neighbour's. Indeed, no 'net access. Cable is plugged in, is connected to the switch (same I was also on).

ipconfig /all

Yes, the IP adress is correct, gateway as well, hrmh, wait: That DNS entry is weird. That's neither inside our dorm's network nor the DFN's network (our uni's ISP).

Set the DNS to a known one - everything worked fine again. So, how did this problem arise? After all, the settings were all on "Auto", so it should have simply used the info it got from our DHCP.

Went back to my room and discovered that my own PC now had no access as well. I got the proper IP but a false DNS entry.

That demanded a detailed examination. Called my fellow admin and we got right on it. After grabbing and examining the traffic on the internal port of our router, we found that we had a rogue DHCP on our network which was just a *bit* faster in answering DHCP requests than our router.

And as we had no managed switches yet, we had to resort to the tried-and-true method of: "Keep unplugging network cables until the bad thing stops!" And stop it did, finally. We traced it down to the PC of a girl who didn't really look like a technological mastermind (she studied Social Paedagogics!) and almost cried when we approached her door with thunderous expressions (though we did leave the torches and pitchforks at home).

We then *strongly advised* her to apply the Scorched Earth tactic to her laptop's OS (and only plugged the cable back into the switch after she demonstrated a clean install).

And the problem was gone. Still, it was weird that this virus/worm/whatever got all our IP adresses right but botched the DNS entry. We actually wouldn't have noticed that and it would've opened our users to serious MITM attacks.