ISPs downplay DNSChanger impact as substitute servers go dark
Clean-up efforts in the last three weeks reduced U.S. infection count by 34%
Computerworld - Government-sponsored servers designed to keep DNSChanger-infected PCs and Macs online were switched off earlier today as scheduled, but several major U.S. Internet service providers downplayed problems to their customers.
The number of IP addresses with infected machines had fallen since mid-June by 34% in the U.S., according to July 4 data from a group of security experts formed to combat the malware. Worldwide, the infection count decreased by 19% in the same period, said the DNSChanger Working Group (DCWG).
DNSChanger, which had hijacked users' clicks by modifying their computers' domain name system (DNS) settings, shunted DNS requests to the criminals' own servers. The hacker-controlled DNS servers then redirected victims to malicious sites that resembled real domains.
At one point, as many as four million PCs and Macs were infected with the malware, which earned its makers $14 million, U.S. federal authorities have said.
As part of last November's "Operation Ghost Click," the FBI arrested six Estonian men -- a seventh, who is Russian, remains at large -- seized more than 100 servers operated by the gang, and then substituted replacement DNS servers for those taken offline. Without the substitutes, DNSChanger-infected systems would have been immediately knocked off the Internet.
Instead, the substitute servers, which were maintained under a federal court order by Internet Systems Consortium (ISC), the non-profit group that maintains the popular BIND DNS open-source software, kept victims online until 12:01 a.m. ET today, when their plugs were finally pulled.
Originally, the stand-in servers were to be turned off March 8, but a federal judge extended the deadline to July 9.
Although some headlines last week touted the impending shutoff as a doomsday event, the number of people affected was actually quite small considering the number of Internet-capable desktops and notebooks.
In the U.S., for example, the 45,619 IP addresses DCWG reported as infected as of July 4 represented just 0.02% of all Internet-able desktops and laptops, or just 2 out of every 10,000 PCs and Macs.
Several large U.S. ISPs also noted the small number of victims. "The number of customers affected [by DNSChanger] is very, very small," said Mark Siegel, an AT&T spokesman, today.
"A very, very small number of our customers have been affected," echoed Alberto Canal, a spokesman for Verizon's FIOS Internet service. "Our call centers are not seeing any activity."
Some ISPs, including both AT&T and Verizon, are keeping customers online by directing their DNS requests to special servers that kicked in when the FBI's replacement systems went dark earlier today.
Siegel said AT&T would operate the substitute-substitute DNS servers until the end of 2012, while Canal said Verizon would run those for its customers through this month only.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts