FBI Preparing to Shut Down Temporary DNS Servers, Kill Unknown Number of Internet Connections
FBI Preparing to Shut Down Temporary DNS Servers, Kill Unknown Number of Internet Connections
Posted 02/16/2012 at 3:52pm
| by Ryan Whitwam
20
Comments
Print
The FBI is currently scheduled to take several temporary DNS servers offline on March 8th; an action that could result in the disconnection of millions of Internet users. This dilemma stems from a nasty trojan that was circulating back in 2011 called DNSChanger. This bug was used to alter a user’s DNS settings, and law enforcement used temporary DNS servers to give everyone time to fix the problem. Experts fear that many systems are still infected, and risk failure on March 8th.
DNSChanger used the modified DNS server settings to route users to malicious (and possibly illegal) domains instead of the ones they intended to visit. The feds worked with Estonian authorities to apprehend the creators of DNSChnager, but that left millions of computers still infected. The fix was to set up a few DNS servers to intercept the traffic from these systems and keep the data flowing. Now that the servers are due to be taken offline, some people might suddenly have busted connections.
DNSChanger was a surprisingly widespread infection that wormed its way into half of all Fortune 500 companies and nearly that proportion of government agencies. There is still a chance that the FBI will be allowed to leave the servers in place a little longer, but no guarantees. Do you think DNSChanger will have one final laugh on March 8th?
More like this
20
Comments
Comments are closed on this article
Athlonite
February 18, 2012 at 8:57pm
I say FUCK em if your to stupid to keep your AV and Anti malware programs upto date then you don't deserve to be let loose on the internet or even to learn a little bit about how to keep an eye on your connection settings then then Fuck off till you do
aarcane
February 17, 2012 at 2:10pm
Sounds to me the answer is the same as a standard Captive Portal setup. You simply specify that all entries forward to a specified IP address, wich serves a website saying "you were previously infexted with this virus. Here's how to fix your DNS settings"
Nimrod
February 17, 2012 at 1:57pm
No. All of these DNS servers belong to me, i bought them. I have them here in my little wire closet. Its a good thing i have the upgraded Comcast high speed! I can restart them now if you want. I dont think their is a worm but i will do a clean install just to make sure there is not.
shahid061
February 17, 2012 at 9:12am
Thе FBI іѕ currently scheduled tο take several temporary DNS servers offline οn March 8th; аn action thаt сουƖԁ result іn thе disconnection οf millions οf Internet users. Thіѕ dilemma stems frοm a nasty trojan thаt wаѕ circulating back іn 2011 called DNSChanger....Quote of the day
rakeshjha
February 17, 2012 at 3:11am
Get direct flights to Nanjing right away at Crystal Travel. Our direct Nanjing flights are available from all the leading airports in the UK. We offer direct flights to Nanjing with the most profitable airlines.
zhoucn9999
February 16, 2012 at 11:55pm
Hi there, I just wanted to mention, I disagree. Your article. doesn't make any sense.
http://www.ebuysilver.com
Nimrod
February 17, 2012 at 1:58pm
fuuuuuuuuuuuuuuuuuuuuuuuuuuckkkkkkkkkkkkk
yoooooooooooooooouuuuuuuuuuuuuuuuuuuuuuuu
biiiiiiiiiiiiiiiiiiiiiiitchhhhhhhhhhhhhhh
BrandNewJesus
February 16, 2012 at 8:07pm
On one hand I wish they would just let them shut down.
If someone is infected, at least they will know something was wrong when things stop working.Its not a big deal for anyone who knows anything about networking.
On the other, all the people who don't know shit will start complaining to their neighbor tech guy that their Internets are broken, and we will have to fix it. And if they are notified that they were infected, we will be asked to clean up their computer. SOOOOO...good job, don't tell them.
ON A SIDE NOTE: I fixed my neighbor computer the other day. Opened the case just to check things out. They smoke in their house. Their was so much nicotine gew stuck to the CPU cooler, I don't think it could suck any air.
My god, that was a new low.
aca20031
February 16, 2012 at 7:33pm
If they're going to take them offline anyway the smart thing to do would be to have them resolve all domains to something like omgmycomputerisinfected.org, i.e. a temporary site to explain what happened and how to fix it. At least for a month or so.
Markitzero
February 16, 2012 at 6:42pm
I don't have to worry all my computers on my Network are not infected and I use OpenDNS on the router even when my ISP uses Google's DNS Servers or Charter's Servers. I don't use ISP's DNS servers no matter were it is connecting to.
aarcane
February 17, 2012 at 2:13pm
You should update from OpenDNS to Google's DNS servers anyway, regardless of whether a former ISP used them or not.
zNelson24
February 16, 2012 at 6:42pm
A warning would have been nice, like 6 months ago ahead of time. Also, I don't see why you would need to kill off several DNS servers just because of a new virus.
compro01
February 17, 2012 at 7:26am
These were temporary DNS servers set up for this purpose, not normal DNS servers.
Basically, the trojan (known as zlob, aka dnschanger) sets the infected system's DNS server to an evil one which sends various sites (e.g. banks) to phishers rather than real sites.
The FBI, working with the Estonian police, took a hammer to those DNS servers last March and replaced them with their own temporary non-phishy servers to prevent disruption. Now they're shutting those servers down.
Belboz99
February 16, 2012 at 6:32pm
You'd think the Feds could at least be nice about it and give them a warning, much in the style that when you login to some public wifi networks you're redirected to a TOS page first before going onto the world wide waste.
Also, you'd think the Feds would know how many PC's were actually using the servers on a daily basis, and perhaps postpone the disconnect until it reaches a lower level of users.
Supall
February 16, 2012 at 6:27pm
It shouldn't be that big of a deal. Most IT departments at businesses and government institutions should have taken care of their issues. The main ones who would suffer are the IT support for ISPs getting calls from irate homeowners wondering why their internet connection is suddenly not working.
Zoandar
February 16, 2012 at 5:58pm
If you manually set your DNS server to the Google server you folks recently recommended for increased performance, might that help protect you from this issue?
AntonioGarrison
February 16, 2012 at 5:47pm
Did it just change the like NIC card DNS settings or the Wireless NIC cards DNS Settings?
Connect with MaximumPC
Featured Content
The gang discusses the GTX 690, Trinity, Ivy Bridge, Amazon, big-box stores, MMOs,...
This month's issue
Feature
Build a PC On Any Budget
Feature
Cloud Services Showdown
How-To
Encrypt Your External Drive
Build It
Upgrade an X58 Rig
Most Commented Articles
Latest Max PC Tweets
- maximumpc: Original RickRoll Video Returns to YouTube After 24-Hour Copyright Hiatus http://t.co/MaH9Sxyy1 day 9 hours ago
- maximumpc: Corsair has decided not to go forward with its $78 million IPO, citing weak equity market conditions http://t.co/A5a4DAzj1 day 9 hours ago
- maximumpc: Want to work at Maximum PC? Our Online Managing Editor, Alex, is moving away, so we need a new one. http://t.co/9Z7JCh0E3 days 7 hours ago
