site Search:


 
   
story category
March 8 D-Day for DNSChanger Infected PCs
As FBI Tries to Tackle Pervasive Scumware
by Karl Bode Thursday 16-Feb-2012 tags: business · security · software · domains
Two months ago law enforcement in Estonia shut down a massive Internet traffic hijacking scheme that used the latest versions of DNSChanger Trojans to hijack search results while blocking victims from visiting security sites. According to security researcher Brian Krebs, DNS Changer remains on computers at 50% of Fortune 500 companies, and on PCs at nearly 50% of all federal government agencies.

Click for full size
The good news? Krebs notes that after the shutdown law enforcement was able to replace the scumware's DNS infrastructure with legitimate DNS servers. The bad news? Those DNS servers stop working on March 8:

Computers still infected with DNSChanger are up against a countdown clock. As part of the DNSChanger botnet takedown, the feds secured a court order to replace the Trojan’s DNS infrastructure with surrogate, legitimate DNS servers. But those servers are only allowed to operate until March 8, 2012. Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web.

The FBI's effort to put DNSChanger to bed has resulted in some fairly silly headlines, such as "FBI might shutdown the Internet on March 8." While the date might not be apocalyptic, it's certainly going to be a busy one for ISP support reps unless the DNSChanger Working Group can somehow get the deadline extended.

view: topics flat text 
Post a:

n2jtx

join:2001-01-13
Glen Head, NY
Reviews:
·Optimum Online

Half?!?!?

This article needs to be rephrased. The statement "roughly half of the computers running at both Fortune 500 companies and government agencies are infected with the malware" is incorrect. From the original article, it says "found evidence of at least one DNSChanger infection in computers at half of all Fortune 500 firms, and 27 out of 55 major government entities". Quite a difference!
--
I support the right to keep and arm bears.

AngryBlakMan
Angry Black Man

join:2007-11-19
USA

Re: Half?!?!?

yea, i read that and not being a moron, realized this was WAY overstating the situation. ironic how the article goes on to criticize other articles for misinterpreting the effect of the FBI's role in this..
treichhart

join:2006-12-12
Reviews:
·AT&T Wireless Br..

2 much power for the feds just to use the kill switch

This court order was just gave the feds way 2 much power to use the international internet kill switch thanks to Obama bs. Now Obama got his wish to do this now we all have to be worried about whats next what he wants to do.

We all know this virus was created by the US government just to give the rights to just shut the internet down because there SOPA/PIPA/ACTA bill didnt pass. So they had to cry about it and they finally got there way.

cdru
Go Colts
Premium,MVM
join:2003-05-14
Fort Wayne, IN
kudos:5
Reviews:
·Frontier FiOS

2 edits

Re: 2 much power for the feds just to use the kill switch

Did you even read the summary? Or the articles linked to? Or have an idea what this article is about form a technical standpoint? Those are all rhetorical questions as the answer is pretty apparent.

The FBI isn't shutting down the internet. This isn't a kill switch. This has nothing to do with Obama. A trojan was written that changed your DNS server to a rogue server. The people that wrote the trojan were apprehended and the bot net was shut down. However the "damage" of the DNS settings had already happened to many servers. The powers that be could have just shut down the DNS servers back two months ago. However that would have left anyone affected with an internet connection that didn't work as the DNS settings were no longer valid. So the FBI setup a clean DNS server(s) to respond to requests to that there wouldn't be a massive problem with hundreds of thousands of computers suddenly without internet access.

Time has run out for those temporary DNS servers without further court approval. If the servers get shut down, then all those computers that should have been worked on the past two months will have problems. The temporary servers at best bought people time to clean their machines. At worst, it just delayed the inevitable problems. The two month delay got companies through the holidays, end of 4th quarter and year end financials, and publicity has gotten out there for corporate IT departments and perhaps ISPs to inform their users about the issue and appropriate measures.

Edited to correct spelling
Chubbysumo

join:2009-12-01
Superior, WI

Re: 2 much power for the feds just to use the kill switch

They should have just shut it down, and made the retards who got this botnet infection deal with it.
talz13

join:2006-03-15
Avon Lake, OH

Re: 2 much power for the feds just to use the kill switch

Agreed!

fAcEtIOUs
Premium
join:2002-03-03
kudos:4
said by treichhart:

We all know this virus was created by the US government just to give the rights to just shut the internet down because there SOPA/PIPA/ACTA bill didnt pass. So they had to cry about it and they finally got there way.

We all know that, right? And pray tell, how do we all know that?
treichhart

join:2006-12-12
Reviews:
·AT&T Wireless Br..
@ cdru yes I read all the stories about it and your just a other blind person who dont see whats happening here. Come on wake up please.

Just think about it the dang thing probably been around for ages and now they just bring it up since the SOPA/PIPA/ACTA bill didnt pass so they have to do make something else up to cover up there BS lies what they really want to do.

Seriously go search the net and really read up on what this whole thing is about and get back to me and then tell me what I am trying to say.

Also go ahead call me the crazy one or say I am one of these conspiracy freaks but dont coming back say I didnt tell you so.....

vpoko
Premium
join:2003-07-03
Boston, MA

Re: 2 much power for the feds just to use the kill switch

Why don't you just clean the trojan off of your computer and then this won't affect you? You're not talking conspiracy theories, you're talking techno-babble.
ISurfTooMuch

join:2007-04-23
Tuscaloosa, AL
Or maybe people can just...I don't know...run Malwarebytes, clean this junk off their computers, and be done with it.

I absolutely agree that the government has been doing some pretty scary things, but this isn't one of them. Just my opinion here, but you'll do the cause of fighting that a lot more good if you discuss the real issues and not the things that don't matter, since, if you keep going off on tangents like this, people will start to tune out the actual threats.
treichhart

join:2006-12-12
Reviews:
·AT&T Wireless Br..
The real question is there a real threat here? I dont think there really is I think its just bunch of government BS going on here. Intill I see it in person which I probably wont because the Feds will use the internet kill switch before then I will still think its government BS just to use the internet kill switch for one day to show how serious they can be if you want to use the internet for your free speech against them. Just like how Iran and China and Syria is doing against there own people. I think US is now the next one in line for it by using this DNS virus attack crap to cover there real thinking is.

Camelot One
Premium,MVM
join:2001-11-21
Austin, TX
kudos:1
said by treichhart:

This court order was just gave the feds way 2 much power to use the international internet kill switch thanks to Obama bs. Now Obama got his wish to do this now we all have to be worried about whats next what he wants to do.

We all know this virus was created by the US government just to give the rights to just shut the internet down because there SOPA/PIPA/ACTA bill didnt pass. So they had to cry about it and they finally got there way.

Based on your post, I must conclude you have found some really good mind-altering drugs.
Please share!
treichhart

join:2006-12-12
Well you must be really blind to search the net then please go search the net and come back and tell me what you find @ Camelot One

Camelot One
Premium,MVM
join:2001-11-21
Austin, TX
kudos:1

Re: 2 much power for the feds just to use the kill switch

said by treichhart:

Well you must be really blind to search the net then please go search the net and come back and tell me what you find @ Camelot One

I would, but due to a long running government conspiracy, I am unable to get result for search terms like "drugs" or "cool stuff". I know the CIA is behind it, but they keep blaming the FBI.
treichhart

join:2006-12-12
Alright man thanks for your unlacking searching time thanks for your laughing time... But seriously its the truth.

Camelot One
Premium,MVM
join:2001-11-21
Austin, TX
kudos:1

Re: 2 much power for the feds just to use the kill switch

said by treichhart:

But seriously its the truth.

No, it really isn't. The US Government did not write and distribute a DNS hijacking trojan just so they could "shut down the internet" of those too stupid to clean their computers after MONTHS of infection.

Though, now that I see the it written like that, I think I support the idea!
FLATLINE

join:2007-02-27
Buffalo, NY
Dude Im embarrassed for you.
treichhart

join:2006-12-12
@ flatline I really dont care if you are. Call me crazy like I said before obviously you guys are just 2 blind to see what is really going down.

Oh_No
Trogglus normalus

join:2011-05-21
Chicago, IL

Re: 2 much power for the feds just to use the kill switch

said by treichhart:

@ flatline I really dont care if you are. Call me crazy like I said before obviously you guys are just 2 blind to see what is really going down.

What is really going on?
Chubbysumo

join:2009-12-01
Superior, WI
Reviews:
·Charter
just quit arguing with the crazy man, he has no idea what the government is actually doing here, and probably does not know what DNS hijacking or a trojan is. Good riddance, and shut it down, quit wasting resources on something, and force the people who still have this to deal with it(as they should have ages ago, since fortune 500 companies deal with customer data that could be compromised(where there is 1, there is usually many). honestly, people need to get off of the windows XPired train, and move to vista or 7, with some decent AV and a hardware firewall(read:router), and common sense 2012, these things would never happen.

Oh_No
Trogglus normalus

join:2011-05-21
Chicago, IL
WTF, I think you need to read the article before commenting.
They shut down a virus and set up a legit DNS to replace the virus DNS. When the shut down the legit DNS all those users will not be able to surf the web anymore.

Anyways in my opinion they should never have set up a DNS to replace the virus DNS. They should just have shut down the virus DNS to stop the stupid users from surfing the internet with their infected PCs. Why would those stupid users fix their computers if they dont see anything wrong?

joako
Premium
join:2000-09-07
/dev/null
kudos:5
Reviews:
·Comcast
Actually quite the contrary. They were able to this without SOPA or any new laws.

If there are legitimate illegal infringing sites, the media companies can do the same thing and get them shut down!

The proposed laws are plain and simple censorship laws.
--
PRescott7-2097
treichhart

join:2006-12-12
Thanks for calling me crazy but dont becoming on here crying and stuff saying that shut down the internet for a different reason which they probably will say something like that. Because I already warned you about it but Thanks Again.

Camelot One
Premium,MVM
join:2001-11-21
Austin, TX
kudos:1

Re: 2 much power for the feds just to use the kill switch

said by treichhart:

Thanks for calling me crazy but dont becoming on here crying and stuff saying that shut down the internet for a different reason which they probably will say something like that. Because I already warned you about it but Thanks Again.

You do understand that turning off a DNS server doesn't "shut down the internet", yes?
sgc

join:2011-11-02
Naperville, IL
said by treichhart:

Thanks for calling me crazy but dont becoming on here crying and stuff saying that shut down the internet for a different reason which they probably will say something like that. Because I already warned you about it but Thanks Again.

Just saying, but if they DID "shut down the internet", he could not come here "crying and stuff", since the internet would have been
"shut down".

Anyway, this is NOT a ploy to "shut down the internet". The SOPA and PIPA acts were NOT the result of the Obama administration; only the republican-dominated House of Representatives. Objectively speaking, and not to get too political regarding this, if Obama proposes a bill, the House generally shoots it down before they can be passed. It's a power struggle that makes it impossible for anything important to be passed through. If you don't understand terms such as Administration, House of Representatives, or republicans, I'd suggest going back to high school to retake the American Government class that you slept through.

I hope you realize that there is no conspiracy. The servers were set up so that there would be enough time for affected users to transition and remove the virus from their machines. However, the government cannot sustain the servers indefinitely due to the obvious expenses. The purpose of the servers was not to replace the functionality but to allow a transition period.
moonpuppy

join:2000-08-21
Glen Burnie, MD

Re: 2 much power for the feds just to use the kill switch

said by sgc:

Anyway, this is NOT a ploy to "shut down the internet". The SOPA and PIPA acts were NOT the result of the Obama administration; only the republican-dominated House of Representatives. Objectively speaking, and not to get too political regarding this, if Obama proposes a bill, the House generally shoots it down before they can be passed. It's a power struggle that makes it impossible for anything important to be passed through. If you don't understand terms such as Administration, House of Representatives, or republicans, I'd suggest going back to high school to retake the American Government class that you slept through.

You were doing well until you spouted off about which party wanted this bill.

This was not solely a Republican or Democratic bill. SOPA was introduced in the House by Representative Lamar Smith (R-TX). PIPA was introduced in the Senate by Senator Patrick Leahy (D-VT). This was a bipartisan efforts at stupidity.

woody7
Premium
join:2000-10-13
Torrance, CA

Re: 2 much power for the feds just to use the kill switch

++++++++++++++
--
BlooMe
treichhart

join:2006-12-12
Reviews:
·AT&T Wireless Br..
When you shut down DNS servers that means you wont be able to browse to different sites as your aware what DNS servers are for so if they shut off DNS server its pretty much like shutting the internet completely off.

I think you need to brush up how dns servers work there.

here is a link how dns servers work:
»www.howstuffworks.com/dns.htm

vpoko
Premium
join:2003-07-03
Boston, MA

Re: 2 much power for the feds just to use the kill switch

I'm guessing, from what you're writing, that you're probably a government agent trying to distract us with nonsense while the FBI goes through BBR's servers and places data loggers on them. How long have you been supporting the new world order?

Camelot One
Premium,MVM
join:2001-11-21
Austin, TX
kudos:1
Looks like they got the extension after all:
»www.msnbc.msn.com/id/46644705/ns···i7dW2xJk

So every IT guy/girl who has been too lazy to do their job for the past several months can now continue doing nothing for another 4 months.
axus

join:2001-06-18
Washington, DC

Feds are going out of their way to keep virus PCs online?

So weird... the way I'm reading it, they are helping people who don't clean up an old virus infected PC. It's a kind thing to do, but people have had plenty of time to clean it up. Time to let them fall off the internet.

cdru
Go Colts
Premium,MVM
join:2003-05-14
Fort Wayne, IN
kudos:5
Reviews:
·Frontier FiOS

Re: Feds are going out of their way to keep virus PCs online?

Technically they aren't virus infected. They ran a trojan which didn't replicate themselves that adjusted their DNS settings. To "cleanup", most users will need to set their DNS settings either back to automatically obtain DNS server via DHCP, or set it back to a static DNS server.

It's not spreading further (unless someone finds and runs the trojan inadvertently). Keeping them on the internet has just prolonged the resolution, but has not increased the damage already inflicted by the trojans.
AndyDufresne
Premium
join:2010-10-30

Comcast users- be aware you have to 6th if infected

»xfinity.comcast.net/constantguar···e/dnsbot

"Constant Guard™ from XFINITY detected that one or more of your computers are infected with malicious software that modifies your computer settings. Action must be taken before March 6, 2012 to avoid disruption to your Internet service. Please follow the instructions listed below to get started."

Option 1 for the win if you are confused.

FBGuy
yippee ki yay
Premium
join:2005-03-19

Re: Comcast users- be aware you have to 6th if infected

Good thing they can't see my traffic. My ISP has no business analyzing my packets.

rrw1313
Premium
join:2001-03-05
Taylor, PA

Re: Comcast users- be aware you have to 6th if infected

Analyzing what packets?

1) You type in »zapatopi.net/afdb/ and your computer has no idea what you mean.

2) It needs to ask a translator at 123.45.67.89 and your ISP gives a map to get there.

3) The that translator says try this number and you computer goes cool I know what it is now and tells your ISP take me here.

All Comcast is doing is saying hey 123.45.67.89 is a bad translator heres how to stop him from sending you off a cliff.
--
"Reality is merely an illusion, albeit a very persistent one." --Albert Einstein:)

FBGuy
yippee ki yay
Premium
join:2005-03-19

Re: Comcast users- be aware you have to 6th if infected

That is a very basic explanation of DNS.

Comcast does not need to provide DNS for me and I do not use their DNS.

joako
Premium
join:2000-09-07
/dev/null
kudos:5

Re: Comcast users- be aware you have to 6th if infected

Comcast performs packet inspection and passes http traffic through a transparent proxy server to display alerts.
--
PRescott7-2097

FBGuy
yippee ki yay
Premium
join:2005-03-19

Re: Comcast users- be aware you have to 6th if infected

I pass all of my traffic through a VPN, no alerts for this guy.

ctceo
Premium
join:2001-04-26
South Bend, IN

I say.

I say take your time, make sure the temporary cutoff is minimal and will function as intended after the tweaks are in place. We don't need any shitty half-ass "patch" to kill our interwebz like some silly DRM crap that nerfs our video games..
cmarin

join:2004-01-13
Boynton Beach, FL

Why not send them to a walled garden?

I don't follow... why would the Feds implement good DNS servers for PC's they know are infected with this scumware? When a request is made from one of these infected machines, why not forward them to a walled garden, where they can inform the user of the infection and disinfection instructions?

Camelot One
Premium,MVM
join:2001-11-21
Austin, TX
kudos:1

Re: Why not send them to a walled garden?

said by cmarin:

I don't follow... why would the Feds implement good DNS servers for PC's they know are infected with this scumware? When a request is made from one of these infected machines, why not forward them to a walled garden, where they can inform the user of the infection and disinfection instructions?

I have been wondering the same thing. But it seems to follow the general thinking of the US Government, that being to legislate/act to protect stupid from himself.
margaf77

join:2000-12-22
Bayonne, NJ
Reviews:
·Verizon FiOS
·Optimum Online

Theres a reason this happens

I think its the fact that It departments are always shortchanged at every turn, they dont produce profit and thus arent important (not to me of course) but meanwhile the costs of this are evident every time there is a data leak or huge mess to clean up that couldve easily been prevented with proper IT policy and the staff and resources to manage it.
Joe12345678

join:2003-07-22
Des Plaines, IL

Re: Theres a reason this happens

or some times they have a over load of contractors and sub contractors.

Like ohio where the off site back plan was just to have a Intern take the tape home with him that worked well up to the time it was stolen out of his car.
Skippy25

join:2000-09-13
Hazelwood, MO

So shut them down....

Im not sure why they even put this in place. How about you shut them down and let those that are infected be exposed to their infection so they can have it taken care of.

Don't really see an issue with even 1/2 of all internet users losing their ability to surf the web. If it happens, get it fixed and then get back online.

Kramer
Premium,Mod
join:2000-08-03
Richmond, VA
kudos:1
Reviews:
·Verizon FiOS
Host:
Microsoft Help
Satellite Radio
Wireless Security

Something doesn't make sense

Why not just redirect all site attempts to a page notifying the user they are infected and to have their computer repaired to restore normal service? Instead they are leaving the malware on the systems and letting people go on their merry way without being aware they are infected. Maybe I am missing something here.

XPAMD
Premium
join:2002-06-08
united state

Re: Something doesn't make sense

THIS!
XknightHawkX

join:2003-02-13
East Peoria, IL

Message from the dns servers?

why not use the dns server they trojan redirected to and have it send the infected pc to a site that explains they have a trojan and have it point to a valid fix. And this doesn't include fake people like cyberdefender. This should happen no matter what site they try to go to.

I know I know. Too much power. They have a trojan and if it's the government providing dns for the time then tell the users they have a trojan don't just let them keep using their computer with the trojan.

Tomek
Premium
join:2002-01-30
Valley Stream, NY

Just Kill it

Once users won't be able to "get on internet" and "post new facebook status" then they may notice that something is wrong.

I don't pay taxes for government to deal with peoples individual problems..
--
Semper Fi
dr_jack

join:2002-04-21
Irving, TX

Re: Just Kill it

said by Tomek:

Once users won't be able to "get on internet" and "post new facebook status" then they may notice that something is wrong.

I don't pay taxes for government to deal with peoples individual problems..

I guess you don't pay taxes that support police or fire departments. When your house is on fire, it is definitely your individual problem.

Tomek
Premium
join:2002-01-30
Valley Stream, NY

Re: Just Kill it

said by dr_jack:

said by Tomek:

Once users won't be able to "get on internet" and "post new facebook status" then they may notice that something is wrong.

I don't pay taxes for government to deal with peoples individual problems..

I guess you don't pay taxes that support police or fire departments. When your house is on fire, it is definitely your individual problem.

Yeah, they come, extinguish it and it is up to me to rebuild it and have it habitable again.

Law Enforcement did the correct thing, they brought network down, it is up to users to get their connectivity back.
--
Semper Fi

fifty nine

join:2002-09-25
Sussex, NJ
kudos:1

Hadn't really noticed here

Guess it's because I and most others here are using mac or Linux.
tmc8080

join:2004-04-24
Brooklyn, NY
Reviews:
·Optimum Online
·Verizon FiOS

google search virus

unless you can target the SPECIFIC dll files & redirects they've hooked into, you've got to WIPE THE WHOLE O/S! many IT departments are reluctant to do this for whatever reason! which is why this continues to be a problem. nevertheless, companies should be on notice that they could have their ISP yank their service until they remove &/or remediate the last 50% of junk PC's out there with this problem.

I wiped mine just after IE9 dropped! Perfect timing for to create a pristine ISO backup image to restore. Next flash point, the next Win 7 service pack! Microsoft should be upto Win 7 Service pack 3 by now..

Wednesday, 23-May 23:33:14 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 12.5 years online © 1999-2012 dslreports.com.