US ISPs Continue To Support DNSChanger Redirection Servers

darthcamaro writes "On Monday of this week, the primary servers that kept those infected with the DNSChanger malware were taken offline. It's a story that sparked lots of media hype with people claiming that hundreds of thousands of people could lose their Internet access. As it turns out, major U.S. ISPs including Verizon, Cox, AT&T and CenturyLink all kept their own DNSChanger servers online, protecting any users from losing their access."

Comments

What's the big deal?

[Jah-Wren Ryel]

Don't all of those ISPs play that dirty trick of redirecting failed DNS lookups to advertising? Why don't they just set their DNSchanger servers to redirect all lookups to some page telling the user that their system is infected and how to download a tool to fix it?

Sure it will break everything but http(s) but if they are happy to do it for money why aren't they happy to do it for the common good?

Re:What's the big deal?

[nurb432]

The big deal is they are keeping infected computers online.

These should have been cut off day one, with a message 'call your isp' and allow NO other traffic to protect the users data.

Oh for the love of god

[0racle]

Knock them off the internet already so they know they have a problem. DNSChanger is probably not the only issue they have.

Re:Oh for the love of god

[bmo]

Knock them off the internet already so they know they have a problem. DNSChanger is probably not the only issue they have.

This. I have *never* seen a compromised system with just one piece of badware. These people are probably running around with dozens, if not hundreds of pieces of evil in their machines.

Knocking them off the net would be doing them a favour.

--
BMO

Re:Oh for the love of god

[bmo]

Any algorithm to decide what machine is infected remotely is not going to be any smarter than the designer, and probably a lot less so.

The thing is that there is no algorithm at work at all except the infection itself.

If you paid attention at all to the goings-on of this issue at all, you'd know that DNS Changer does what it's titled to do: point at a (formerly) criminally controlled set of DNS machines. These have since been commandeered by authorities and maintained. The infected machines are being artificially propped up. To "disconnect" people, all they have to do is turn these off and let the end users fend for themselves.

So let me repeat: there is no "remote turnoff" being done here. The computers are left without a DNS when the fake DNS machines are turned off. If your computer does not point at a valid DNS when they turn off the fake DNS, it is 100 percent guaranteed that you have the DNS Changer malware.

--
BMO

Why?

[Technoodle]

This is a fail. The problem will not go away if we keep coddling people that have infected machines.

"Loose"?

[danomac]

It's a story that sparked lots of media hype with people claiming that hundreds of thousands of people could loose their Internet access.

That was the problem initially, the computers were too loose and malware got in.

Commercial Decision

[sociocapitalist]

"...protecting any users from losing their access."

This had nothing to do with protecting users. This was because the ISPs didn't want to be overwhelmed with support calls and have to deal with X ignorant and pissed off customers who don't know DNSChanger from a hot dog and who will just blame the ISP for any outage.