Slashdot Mirror
Disconnection of Millions of DNSChanger-Infected PCs Delayed
tsu doh nimh writes "Millions of computers infected with the stealthy and tenacious DNSChanger Trojan may be spared a planned disconnection from the Internet early next month if a New York court approves a new request by the U.S. government. Meanwhile, six men accused of managing and profiting from the huge collection of hacked PCs are expected to soon be extradited from their native Estonia to face charges in the United States."
Just a bunch of hype. The Internet will not blow up if the US Federal Governement doesn't save us from the trojan.
I really don't see the big deal, I mean I
Allowing the infected computers to fail is probably best. They'll stop working, then get replaced or cleaned up. How is that bad?
btw, you can read this guide to check your dns.
http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf
Does the problem apply to Mac OS or Linux? Please be specific.
Slashdot, fix the reply notifications... You won't get away with it...
Another example of how the US government is trying to shield people from the consequences of their actions.
I want to delete my account but Slashdot doesn't allow it.
Maybe they're trying to eliminate terrified support calls "help help help some virus called DHCP is changing my dns servers just like the one I read about on the news help help help"
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Why not use the dummy DNS servers to redirect users still attached to them to an informational website that tells them how to unfuck themselves? Make it a clearly labelled site with a very simple, obviously .gov URL so people trust it? If my ISP can pop up a frame telling me I'm approaching the bandwidth cap, why can't the FBI?
seg fault
To me, the real story is that the people behind this botnet are getting extradited and, (knock wood), will do jail time in the US. This news made my day. I know this is slashdot, but malware is not going to be fought through any technical solution. Until this kind of activity carries personal risk, the bad guys are going to win.
Nice to actually feel good about my government, at least for a few minutes.
Shut the surrogate control servers down. The main reason people don't take security seriously is there's never any real costs associated with not taking it seriously. Most of the users of the infected machines probably are thinking "Why should I worry about this? My machine's working just fine.". Well, when the control servers shut down and the infected machines can't access the network at all, the users won't be able to keep ignoring the problem. And maybe, just maybe, having to pay the price for complacency will make them not be quite so complacent in the future.
Is extradition a requirement for justice to be served ?
To me, the real story is that the people behind this botnet are getting extradited and, (knock wood), will do jail time in the US.
While I would be happy for the creators to rot in prison, this is also scary. Why should they be extradited to the US? /. commenters get outraged at mention of the megaupload folks being extradited simply because they disagree with the laws that were allegedly violating. It was the same excuse that it related to machines in the US. What makes the US so friggin' special for them to be extradited? Is what they did not illegal in Estonia? If not, then should they be prosecuted for actions they took while in a country where it wasn't illegal? If so, then why aren't they being prosecuted in Estonia, where they actually were when they did illegal stuff? If we're in one country doing business with another country over the Internet, or doing something on servers in another country, which country's laws should apply? Which country should get to prosecute?
Meanwhile...I still get a dozen 419 scam emails for every craigslist ad I post. While everyone reading this probably thinks that only an idiot would fall for them, there are clearly people who do. Just because somebody isn't computer literate doesn't make them an idiot, there are real people losing real money, and yet the scammers aren't prosecuted because they're "over there" even though they're scraping craigslist's US based servers, sending email to servers and people in the US, receiving money fraudulently through Western Union, a US based company, from the US.
What kind of precedent do we want? Can we at least be consistent?
Sometimes.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
What the fuck, another extradition to the US. I wonder if the US would extradite its citizens to Estonia if the Estonian government asked for it.
FTA linked
"The government argued that the arrangement would give ISPs and companies time to identify and scrub infected PCs, systems that would otherwise be disconnected from the Internet if the control servers were shut down"
The quickest way to indemnify them is to have them removed from the internet.
computer user: "hey why is this computer not connecting to the internet"
another computer user: "dont know, guess we better get someone that knows something"
someone that knows something: "so this is why...and this what you did and this is how we are going to fix it"
computer user "yay im on the internet"
seems a little more simple then the governments solution...
"Not some mystery benefactor, singular. That would raise too many questions. However... stay with me here... Zombies. I got a guy who knows this guy who knows this Rain Man-type. He lives with his mother in her basement in Belarus. So good luck extraditing his fat Russian ass. Wait. He's a hacker-cracker extraordinaire. This guy can hijack random desktops all around the world, turn 'em into zombies that do his bidding. For instance, he can make it so, 20 or 30,000 little donations come in from all over the U.S. and Canada. 10, 20, 50 bucks a pop, all paid in-full, nice and neat, untraceable, from the good-hearted people of the world to Mr. Walter H. White, Cancer Saint." -- Saul Goodman, Breaking Bad, Phoenix.
"MIT betrayed all of its basic principles."
"Why should they be extradited to the US?"
Because they damaged US computer systems on US soil.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
While I would be happy for the creators to rot in prison, this is also scary. Why should they be extradited to the US? /. commenters get outraged at mention of the megaupload folks being extradited simply because they disagree with the laws that were allegedly violating. It was the same excuse that it related to machines in the US. What makes the US so friggin' special for them to be extradited? Is what they did not illegal in Estonia? If not, then should they be prosecuted for actions they took while in a country where it wasn't illegal? If so, then why aren't they being prosecuted in Estonia, where they actually were when they did illegal stuff? If we're in one country doing business with another country over the Internet, or doing something on servers in another country, which country's laws should apply? Which country should get to prosecute?
Why so many questions? In theory these people violated laws in both counties and will be punished in both countries. Why shouldn't they? Some of this is in the treaty with Estonia, especially article 2. 419 scammers are prosecuted when caught. What makes you think they aren't?
The only users who should be affected are home home users, and its not going harm the economy any if John and Sally can't get to Facebook until they pay their local Nerd Herd agent $60 to fix their PC. Hell it might help the economy because its going to spur some activity, and result in those machines getting cleaned and patched which will in turn prevent future frauds and botnets.
As to the F500's, and even the smaller down to a hindered or so head count shops. This should be a non issue. First they probably have cleaned things up by now. They probably do have the tools to find and fix compromised systems if someone would just get off their rear ends.
Second if they don't know where the infected boxes are and don't have the minimal logging it would take to find them etc, they do have a firewall which can do NAT. Lets face it if you can't tell if your systems have correct DNS settings you are not running DNSSEC or anything that would cause an issue. A line or two on your firewall device could get added to simply DNAT and thing destine to a DNS port to a trusted server. Oh larger shops might have to add an additional line or two to exempt a system like their own NS server but even so its about 20 min worth of work on a Sunday night for one person, and few staples in the Change control docs Monday morning.
Frankly if your letting DNS out to the big bad internet from your client PCs, you really need to replace the people in your IT Security and Infrastructure groups anyway; they don't know what they are doing.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
From what I've read this doesn't sound any more stealthy or tenacious than any other modern trojans. If you're running up-to-date AV like you should, then you should already know you have an infected computer (and be doing something about it). I don't see why anything out of the ordinary needs to be done. Just shut down the rogue servers. If people didn't know they had a problem before, they will then. How would this be any different from a virus that simply disables your internet connection? I see complaints about the cost to ISPs and tech support that will wind up fielding calls from the clueless plebs, but why would this be handled any different from all the other calls they receive? I realize it means you'll have a busy work week, but such is the price of business.
The individuals in question allegedly damaged networks located on United States soil, and we happen to have an extradition treaty in place with Estonia. Wikipedia lists the following references to US/EST treaties:
Some nations do not have extradition treaties with certain other nations, but this generally makes it rather more difficult for them to get their hands on accused criminals operating from and/or fleeing to "unfriendly" jurisdictions. Thus, such treaties are quite popular, and are generally mutual in nature between various nations and regional blocks.
Write failed: Broken pipe
isn't a bit silly to extradite people who commited a crime in another country to be charged for crimes here? i mean, c'mon now. it it will be done, i'd have to argue an all or nothing approach to this. (i.e. all violators of u.s. law in a foreign nation or none). also, if it comes to picking and choosing, slippery slopes are slippery.
*dons crazy hat*
If the U.S. wants extradition rights abroad, effectively granting them temporary dominion over foreign citizens, perhaps the very concept of country boundaries should be deemed obsolete. I want a unitary world government, not this so-called New World Order founded on lies, violence and greed.
Further down the Star Trek fantasy, if we didn't have global financial abuses, heck - finances at all - there would be no incentive for black hats to hijack computers and defraud total strangers and this whole fiasco would never have happened in the first place.
Adding more layers of bullshit to a flawed system does not fix it. Dismantling the system will.
-Billco, Fnarg.com
... is track down the owners of these computers and charge them ALL with the misdemeanor aiding and abetting cybercrimes. Let's put the blame where it belongs ... on dumb people who allow their computers to be infected. In this case, since there was no damage by these owners to others, it can be a misdemeanor. But if it did involve damage to others, then it should be a felony charge.
now we need to go OSS in diesel cars
"Why should they be extradited to the US?"
Because they damaged US computer systems on US soil.
They didn't infect the computers. The computers' users infected them.
They cannot stop the servers, because then half of government machines will stop working too...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Because they damaged US computer systems on US soil.
Awesome. Does that mean other countries can extradite US politicians and business men for screwing over companies and in some cases entire countries?
Oh right, what was I thinking... :\
Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.
While I would be happy for the creators to rot in prison, this is also scary. Why should they be extradited to the US? /. commenters get outraged at mention of the megaupload folks being extradited because they disagree with the laws that were allegedly violating.
ftfy. It *is* valid to get outraged when someone is extradited over a law I disagree with. =whoosh=
The really scary news is the fact these guys are getting extradited.
It's not that they don't deserve great eternal suffering, it's just that this is getting out of control.
Genuine question - when was the last time US has extradited its own citizen?
Would US extradite a person who killed 24 civilians? If not, why (besides blackmails/threats from US govt) are people supposed to extradite people to the US? Will we have US requesting extradition for someone talking bad about their president (sorry - CEO), in 5 years time?
People don't realize what's coming, I am afraid :(
The leader of the suspects, Vladimir Tatin, may be a resident of Estonia, but he certainly is not Estonian.
The US Government has preasured Estonia to not extradite non-nationals and to give them residency. Vladimir Tatin is previously sentenced for fraud and has served jail time for that crime.
Noeworthy are also the attacks that Russia has launched against Estonian public institutions, where they have received help from russians living within the Estonian borders, which has been made possible thanks to the same US Government preasures.
Let's try "Because their attack directly affects systems owned and operated by our Fortune 500 and USG Overlords."
Complete BS! Please learn the basics of TCP/IP!
The link you noted gives one the answer to do it, & as easily as a login script (.cmd file etc.) with .reg file merges to undo those incorrect redirect settings for DNS requests, back to "normal" for those folks' network.
Additionally/After that?
Then, by using registry ACL policies @ Active Directory levels network wide (pretty much just like filesystem ones for NTFS)?
Then, you can assign access to that registry hive key to ONLY the local SYSTEM logon entity and perhaps yourself as a domain level admin (as far as alteration rights on this part) & users only being 'read only' (UAC will do the rest).
APK
P.S.=> It's just an idea, but one that would probably "nullify" this malware (along with removing ANY & ALL traces of its working parts in executables etc./et al, also, of course)... Personally, I am surprised this hasn't BEEN done already, actually, in regards to this particular infestation...
... apk
Is what they did not illegal in Estonia?
No, it probably is not illegal. Let's see, what country has the most Windows machines? Probably the US is #1 there. So anything that negatively affects Windows machines will have a predominately bad effect on US computer users.
I wouldn't be surprised if there is a specific (unwritten) law in Estonia that says "If you screw with Americans, hat's off to ya." There certainly is such a law in Romainia and Bulgaria.
It may also be the case that in Estonia anything that is done "online" gets a free pass because it did not happen in the physical world. If you steal from someone "online" it is very difficult for them to pick you out of a lineup. Similarly, if you haven't left the country and the victim never came to Estonia, then how could you possibly have stolen anything from them? Next case!
Many countries do not have laws dealing with Internet crimes in any way whatsoever and their legal system considers the whole idea of "virtual" crime to be nonsense. If you stick a gun in someone's face and demand their wallet, yes, that is illegal. If you get their bank account information and transfer yourself everything they have, well, that's different - they gave you that information, didn't they? Oh, they thought they were giving it to someone else... too complicated and sounds "virtual" anyway. Next case!
Unfortunately, the threshold for international enforcement is very, very high. Way too high for 419 scammers to get prosecuted. As far as Western Union is concerned, everyone should know by now that only criminals use Western Union for anything at all. If you aren't a criminal, there are other ways of sending money around that do not involve Western Union in any way. Western Union has consistently refused to do anything that would prevent criminal use of their money laundering ... er, I mean money transferring ... and the result is every single time I see anything about Western Union is it for criminal enterprises. This by itself should doom Western Union but there seems to be enough folks thinking they are going to get paid for transferring money around that they can keep going.
Adding more layers of bullshit to a flawed system does not fix it. Dismantling the system will.
Before you tear your house down you'd better build a new one, or you'll get wet and cold. You have a system in mind that's better than the present one that doesn't involve matter replicators?
Free Martian Whores!
So after they do their time in the US they're going to be judged in each country where a machine was infected? That's fucking scary!
And if I have a website explaining people how to use TOR, and it turns out that explaining this is illegal in China or in North Korea, will I be extradited to those countries?
Organize a worldwide format day. That should solve the problem.
My house is fine as it is. It's my neighbor who's a total dick.
-Billco, Fnarg.com
It's true for users who don't realize their freaking DNS servers have been changed... Facebook doesn't open = no internet. What I don't understand is why they don't setup a captive portal that opens a message for them saying they are infected whenever they try to go to any website, instead of just shutting the servers down. And while we're on the subject - is it being delayed or not!?
Bow before me, for I am root.