Slashdot Mirror
Taking Down DNSChanger: A First Person Account
penciling_in writes "Paul Vixie shares his personal account of the DNSChanger takedown operation, working with the FBI and a worldwide team. He also explains the delay issues in identifying and notifying victims, which resulted in the FBI asking the judge for an extension. They were given four more months. 'On July 9 2012 the replacement DNS servers operated by ISC will be shut down and any victims who still depend on these servers will face new risks,' he warns. A half-dozen national Internet security teams around the world have created special websites that will display a warning message to potential victims of the DNS Changer infection. The full list of these 'DNS Checking' websites is published by the DNS Changer Working Group."
Probably the most interesting side of "just another windows virus" story for non-windows users, is that 4-letter-acronym domains are available.
I heard all the TLAs have been domain squatted since the mid 90s... I was honestly surprised its possible to obtain a FLA domain (four letter acronym), or at least it was possible for these guys for this one domain...
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
It seems like Google would be in a position to quickly nip problems like this in the bud. If they implemented whatever the checks these systems are doing on their search result page, 99% of those infected would know about it.
I don't care about the unibrow, but I have to admit I thought Paul Vixie would look more dashing.
I'm not sure why, but I pictured him as a cross between Indiana Jones, Flash Gordon and Dilbert.
They never should have setup replacement DNS servers.
At most they should have put up a special server that just pointed every A record request to webserver with page explaining that you have or have had some malware on your system and are vulnerable, some instructionss to fix your DNS and patch your box or call your Administrator for help. Simply return NXDOMAIN for everything else.
All this has accomplished is keeping a bunch of un-patched machines which lets face it most likely have or will have other malware on them as well in use by users making the possible victims of someone else.
I have not bought into the argument about ISPs or corporate uses being effected severely either. Anyone effected by this thing is not using DNSEC. It would be trivial to NAT tcp53/udp53 requests to the addresses of the malicious DNS servers to safe in house one. ISPs and corporations then could go through those logs with their own resources and contact those users / customers for a fix, instead of being allowed to just shift the cost of their security failure onto the tax payer as they have. Such organizations should be going after the estate of the perps for damages and eating the costs that cannot be recovered or forcing their insurers to do it.
This was just another abuse of the public.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
There should have been a period of time to do the notifications with the DNS running "normally". At the end of that (no extension), change the DNS servers so they return an IP for ALL domains that directs everything to a single page that tells them that their computers and/or network is infected, and they need to contact a security consultant, their ISP, or a specified contact at the FBI. After that time, the DNS should go dead (route those IPs into a blackhole). That all should have been overwith by now. There's no justification to delay further for stupid people.
now we need to go OSS in diesel cars
and I'll say it again. Why are we going though all this trouble? Just shut down the damn servers, or if you want to be nice redirect to a page explaining that they're infected. It takes me around 15 seconds to change my dns servers, but for some reason we need to drag this shit out til July.
You're complaining about a tech writer's unibrow?
This is way worse.
The original author of cron and bind is a "tech writer"? The man who claims to hold the record for the most CERT advisories due to a single author? When it comes to the Internet, the man has at least demi-god status, and when it comes to DNS, I think you have to call him a full-fledged god.
Sure, they don't want to kill the internet connections of thousands (or millions) of people in one night, this will cause the odd serious problem.
But leaving some servers running perfectly isn't going to solve anything either. If everything is working fine these people are just going to leave it be; as they were told by the last guy who charged them to fix their machine last time!
The answer is actually very simple; leave the server running but make sure it's CRAP.
On day zero it works perfectly.
On day one just one percent of queries are given a serverfail.
On day two two percent are failed
By the end of the first week people will start to notice that their internet is getting crap.
By the end of the first month they will be asking around for help
By the end of the second month they'll be ready to pay for help
And finally, after just three months (and a week) the servers can be turned off, they're not doing anything anymore.
If you actually RTFA, you will find this little checker for DNS Changer on your machine:
http://dns-ok.us/
This could use a bit more publicity.
The original author of cron and bind is a "tech writer"?
You're right at large, but he wasn't the original author of cron. He made the first(?) free clone.
I don't care about the unibrow, but I have to admit I thought Paul Vixie would look more dashing.
I'm not sure why, but I pictured him as a cross between Indiana Jones, Flash Gordon and Dilbert.
I pictured him as dark, handsome, but boyish. With rather long, black, curly hair. Funny how we make our own portraits of programmers, as if they were characters in a novel.
I was "shut down" by my ISP from the FBI's request due to a mistaken identification on their part to having the DNSChanger virus on my subnet.
Turns out I didn't have the virus, but a SPAM had arrived on my email server that tickled traffic to one of the domains in question, because my email server rather legitimately wanted to check to see if the domain existed.
BUT I'm majorly irritated because they informed me that I "had the virus" then summarily shut down my external DNS traffic, breaking my access to the net, without even giving me time to check to see what was going on.
Erich Boleyn
This is an insult to all inter-ocularly hirsute techs everywhere. We who sport the unibrow (or monobrow as it is known in Australia) - all look up to Mr Vixie, and I myself am proud to have been compared to Mr Twit of Roald Dahl's inspiring book, "The Twits" fame.
Such comments are just jealousy, I suppose.
I am not a robot. I am a unicorn.
Sue. It's the only way to force your ISP to double check next time. Make it too expensive for them to be lazy.
Simple: This -> http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&qs=ns&form=QBLH
(Just by using the principles of "layered-security"/"defense-in-depth" AND educating users... they are the "weakest link"!)
To "immunize" a Windows system, I effectively use the principles in "layered security" possibles!
http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE
I.E./E.G.-> I have done so since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:
http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text
& from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml which Neowin above picked up on & rated very highly.
That has evolved more currently, into the MOST viewed & highly rated one there is for years now since 2008 online in the 1st URL link above...
Which has well over 500,000++ views online (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:
---
1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the Lord works in mysterious ways", it even got me PAID -> http://techtalk.pcpitstop.com/2007/09/04/pc-pitstop-winners/ (see January 2008))
---
Across 15-20 or so sites I posted it on back in 2008... & here is the IMPORTANT part, in some sample testimonials to the "layered security" methodology efficacy:
---
SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2
"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral
AND
"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral
AND
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My clien
PERTINENT QUOTE I'VE LONG BEEN USING:
"(Especially for noob/grandma level users who are unaware of how to secure themselves in fact, per a guide like mine noted above that uses "layered-security" principles!)" FROM THIS VERY EXCHANGE HERE TODAY NO LESS -> http://it.slashdot.org/comments.pl?sid=2752399&cid=39524771 (and one I've long used in my security posts here, especially regarding hosts files vs. DNS alone)
* Complete with GUI level directions (vs. using .reg file merges &/or AD group policies via secpol.msc &/or gpedit.msc for Windows Active Directory networks))...
(Router level checks should also be included as well as OS level DNS settings for servers used... I recommend a few good ones for non-AD users in that post above, that actually ACTIVELY filter out known bad hosts-domains and even bad DNS servers too!)
APK
P.S.=> See my 'p.s.' there, because I rather STRONGLY imagine your directions mirror my own on this very note (& doing it in the registry is a simple .reg file merge to this area in the TCP/IP parameters settings, here:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\DhcpNameServer
Using regedit.exe (or .reg file merges on user logon via logon scripts), & then making it READ ONLY to end-user workstation nodes & editable ONLY by the AD domain-wide admin level user(s) only... to stop reinfestation - once more, checking DNS information in any routers used is good to work in combination with this, also... apk
Does the malware have AD domain-wide admin rights? If not, and I doubt it does??
This would stop THAT, easily (see my p.s. @ the bottom of the link I post next):
http://it.slashdot.org/comments.pl?sid=2752399&cid=39526333
* That'll stop the thing from working!
It's also as simple as .reg file merges of VALID DNS servers into an end-user workstation via logon scripts, for this area to be "set right":
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\DhcpNameServer
Then, also doing AD gpedit.msc + secpol.msc work @ an AD (active directory) wide level... I add in NortonDNS, OpenDNS, & ScrubIT DNS servers there in "triumvirate" layered-security + 'failover' zone-defense type thinking too, & mainly because those DNS, for stand-alone non-AD systems, actively FILTER vs. known bad hosts-domains AND BOGUS DNS SERVERS TOO!
Which then, you'd be making ONLY the domain level admin user group have rights to change that area (dhcpnameserver in TCP/IP parameters) in the OS, & router level goes without saying only admins should have the security clearances for that much as well!
APK
P.S.=> I showed how one can do it "grandma noob level end user" work via GUI to do the same, here, in this exchange also:
http://it.slashdot.org/comments.pl?sid=2752399&cid=39524771
In its 'p.s.' section @ its termination as well... either way? It will STALL this thing, & then you remove the actual bogus ware or links that caused it (firewalling rules tables &/or HOSTS files can do the job there nicely)
... apk