ISPs Provide DNSChanger Life Line

Wednesday, July 11, 2012 @ 02:07 PM gHale


Right on schedule, the DNSChanger Working Group’s replacement DNS servers went offline this past Monday.

That move was going to leave around 300,000 machines without Internet service. But a group of ISP, configured their own substitute DNS servers, so some machines still have a safety net.

RELATED STORIES
DNSChanger Trojan Still in Play
‘Doomsday’ Warning Pop Up Legit
FBI Relaunches DNSChanger Efforts
Fake Police Trojan Demands Funds

What this means is that “infection count continues to decrease without a major crisis in support calls,” according net security firm F-Secure. The Finnish security firm fielded three DNSChanger support queries of its own the day the servers went down.

DNSChanger messed up the domain name system (DNS) settings of infected machines, redirecting surfers to dodgy websites as part of a long-running cybercrime. The FBI dismantled the botnet’s command-and-control infrastructure back in November, as part of Operation GhostClick.

The takedown would have left compromised Windows machines without the ability to reach services that resolved domain names into IP addresses, leaving them effectively cut off from the net. A court order, twice extended, allowed the Feds to set up replacement DNS Servers. This provision died off Monday, but even after months of advanced notice, there was still a bunch of machines that remained infected.

More than four million Windows PCs ended up infected by DNSChanger and that number is now below 270,000.

“According to the latest IP count, the number of affected users in the UK has dropped to just 13,832, down from 19,589 on June 11,” said Sean Sullivan, security advisor at F-Secure. “Clearly, the publicity surrounding the deadline has helped to raise awareness and the message is getting through that users need to clean up their computers.

“What we have seen is that some large Internet Service Providers have set up their own substitute DNS servers so their customers can stay online,” Sullivan said. “So, despite the FBI being out of the game, that doesn’t necessarily mean that customers will be cut-off. It won’t solve the problem completely though, and these users will find that they can’t access the Internet on their laptops from a Wi-Fi hotspot or friend’s house.”



Leave a Reply

You must be logged in to post a comment.