Slashdot Mirror
Taking Down DNSChanger: A First Person Account
penciling_in writes "Paul Vixie shares his personal account of the DNSChanger takedown operation, working with the FBI and a worldwide team. He also explains the delay issues in identifying and notifying victims, which resulted in the FBI asking the judge for an extension. They were given four more months. 'On July 9 2012 the replacement DNS servers operated by ISC will be shut down and any victims who still depend on these servers will face new risks,' he warns. A half-dozen national Internet security teams around the world have created special websites that will display a warning message to potential victims of the DNS Changer infection. The full list of these 'DNS Checking' websites is published by the DNS Changer Working Group."
Probably the most interesting side of "just another windows virus" story for non-windows users, is that 4-letter-acronym domains are available.
I heard all the TLAs have been domain squatted since the mid 90s... I was honestly surprised its possible to obtain a FLA domain (four letter acronym), or at least it was possible for these guys for this one domain...
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
It seems like Google would be in a position to quickly nip problems like this in the bud. If they implemented whatever the checks these systems are doing on their search result page, 99% of those infected would know about it.
I don't care about the unibrow, but I have to admit I thought Paul Vixie would look more dashing.
I'm not sure why, but I pictured him as a cross between Indiana Jones, Flash Gordon and Dilbert.
They never should have setup replacement DNS servers.
At most they should have put up a special server that just pointed every A record request to webserver with page explaining that you have or have had some malware on your system and are vulnerable, some instructionss to fix your DNS and patch your box or call your Administrator for help. Simply return NXDOMAIN for everything else.
All this has accomplished is keeping a bunch of un-patched machines which lets face it most likely have or will have other malware on them as well in use by users making the possible victims of someone else.
I have not bought into the argument about ISPs or corporate uses being effected severely either. Anyone effected by this thing is not using DNSEC. It would be trivial to NAT tcp53/udp53 requests to the addresses of the malicious DNS servers to safe in house one. ISPs and corporations then could go through those logs with their own resources and contact those users / customers for a fix, instead of being allowed to just shift the cost of their security failure onto the tax payer as they have. Such organizations should be going after the estate of the perps for damages and eating the costs that cannot be recovered or forcing their insurers to do it.
This was just another abuse of the public.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
There should have been a period of time to do the notifications with the DNS running "normally". At the end of that (no extension), change the DNS servers so they return an IP for ALL domains that directs everything to a single page that tells them that their computers and/or network is infected, and they need to contact a security consultant, their ISP, or a specified contact at the FBI. After that time, the DNS should go dead (route those IPs into a blackhole). That all should have been overwith by now. There's no justification to delay further for stupid people.
now we need to go OSS in diesel cars
and I'll say it again. Why are we going though all this trouble? Just shut down the damn servers, or if you want to be nice redirect to a page explaining that they're infected. It takes me around 15 seconds to change my dns servers, but for some reason we need to drag this shit out til July.
The original author of cron and bind is a "tech writer"? The man who claims to hold the record for the most CERT advisories due to a single author? When it comes to the Internet, the man has at least demi-god status, and when it comes to DNS, I think you have to call him a full-fledged god.
Sure, they don't want to kill the internet connections of thousands (or millions) of people in one night, this will cause the odd serious problem.
But leaving some servers running perfectly isn't going to solve anything either. If everything is working fine these people are just going to leave it be; as they were told by the last guy who charged them to fix their machine last time!
The answer is actually very simple; leave the server running but make sure it's CRAP.
On day zero it works perfectly.
On day one just one percent of queries are given a serverfail.
On day two two percent are failed
By the end of the first week people will start to notice that their internet is getting crap.
By the end of the first month they will be asking around for help
By the end of the second month they'll be ready to pay for help
And finally, after just three months (and a week) the servers can be turned off, they're not doing anything anymore.
The original author of cron and bind is a "tech writer"?
You're right at large, but he wasn't the original author of cron. He made the first(?) free clone.
I don't care about the unibrow, but I have to admit I thought Paul Vixie would look more dashing.
I'm not sure why, but I pictured him as a cross between Indiana Jones, Flash Gordon and Dilbert.
I pictured him as dark, handsome, but boyish. With rather long, black, curly hair. Funny how we make our own portraits of programmers, as if they were characters in a novel.
This is an insult to all inter-ocularly hirsute techs everywhere. We who sport the unibrow (or monobrow as it is known in Australia) - all look up to Mr Vixie, and I myself am proud to have been compared to Mr Twit of Roald Dahl's inspiring book, "The Twits" fame.
Such comments are just jealousy, I suppose.
I am not a robot. I am a unicorn.
Sue. It's the only way to force your ISP to double check next time. Make it too expensive for them to be lazy.