NWA-PCUG Newsletter Article, May 2012
FBI: Hundreds of Thousands of Computers
May Lose Internet on July 9

By Ira Wilsker, Radio Show Host,
Columnist, College Professor and deputy sheriff
iwilsker@sbcglobal.net
(click to email author)

WEBSITES:
http://www.fbi.gov/news/stories/2011/november/malware_110911
https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS
http://www.dcwg.org
http://www.dcwg.org/detect DETECT IF COMPUTER IS AT RISK
http://news.yahoo.com/hundreds-thousands-may-lose-internet-july-181324701--finance.html
https://www.techsupportalert.com/content/how-check-if-your-computer-has-been-infected-wide-spread-dns-hack.htm
http://www.techsupportalert.com/content/how-change-dns-server.htm
http://www.techsupportalert.com/content/how-find-best-dns-server.htm
http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf
https://en.wikipedia.org/wiki/Domain_Name_System
https://code.google.com/p/namebench FIND FASTEST FREE DNS
https://use.opendns.com HOW TO RESET DNS ON ANY OPERATING SYSTEM
https://developers.google.com/speed/public-dns/docs/using HOW TO RESET DNS ON ANY OPERATING SYSTEM

In case you have not heard the news, on July 9, 2012, hundreds of thousands of computers will lose access to the internet. This is not some hoax or urban legend, but a fact announced by the FBI. Following the arrest of an Estonian hacker group which had made millions of dollars from a fraud scheme that infected millions of computers worldwide with a "DNS Changer" malware that redirected legitimate commercial transactions to a series of scam websites. These cyber crooks created a sham company called "Rove Digital" to receive the revenues of the scam. DNS is an acronym for a Domain Name Server, which serves somewhat like an internet phone book, which converts web addresses, also known as domain names (such as http://www.theexaminer.com), into an IP (Internet Protocol) address (theexaminer.com is really 50.116.108.205). By changing the Domain Name Server accessed by an infected computer, it is like replacing an authentic phonebook with a purloined one that has the correct names, but intentionally different phone numbers. Dialing a correct phone number will intentionally connect you to someone who pretends to be the person whom you called, and that person is a crook; this is what the DNS Changer malware does to an infected computer. As many as 500,000 American computers may have been infected by this DNS Changer malware, as were an estimated 4 million other computers around the world. In addition to modifying the computer's DNS, the malware also made the infected computers vulnerable to a variety of other malware. The rogue servers were hosted in Estonia, New York, and Chicago.

This scam was very lucrative to the Estonian hackers who made an estimated $14 million in illicit fees. According to the FBI, this cyber-gang started infecting computers with the DNS Changer malware in 2007, successfully infiltrating millions of computers owned by individuals, businesses, schools and colleges, and government agencies, including NASA. The malware was able to penetrate many of the antivirus products in use, and prevented the installed antivirus and operating system software from updating, which would have likely enabled the antivirus software to detect and kill the DNS Changer. Since the security software would not be updated, there would be no protection from the thousands of new viruses, worms, and Trojans that appear every day, which allowed those computers to become infected with countless additional malware programs and other threats. According to the FBI, “They were organized and operating as a traditional business but profiting illegally as the result of the malware. There was a level of complexity here that we haven’t seen before.” Since DNS Changer redirected the unsuspecting victims to rogue internet servers, the crooks were able to manipulate the destination of the web connections. In one example of how this scam worked, the FBI said, "When users of infected computers clicked on the link for the official website of iTunes, for example, they were instead taken to a website for a business unaffiliated with Apple Inc. that purported to sell Apple software. Not only did the cyber thieves make money from these schemes, they deprived legitimate website operators and advertisers of substantial revenue." The FBI announced the arrest of the "Rove Digital" Estonian hackers on November 9, 2011.

Since there are likely millions of computers still infected with the DNS Changer malware, the sudden shutdown of those rogue servers would have prevented the victims from accessing many of their favorite websites. In order to allow the infected computers to continue to access the internet, but actually reach their intended websites. the FBI arranged for the rogue servers to be temporarily replaced with legitimate servers, such that the victims' internet access is not disrupted. It is these temporary replacement internet servers that will be shut down on July 9, meaning that anyone who still has a computer infected with DNS Changer as of that date may lose internet access.

In order for users around the world to determine if their computers are infected with the DNS Changer malware, a consortium of academic, governmental, and private organizations created the DNS Changer Working Group (DCWG), which initially administered the servers that replaced the illicit Rove Digital servers. The DCWG consists of representatives from Georgia Tech, Internet Systems Consortium, Mandiant, National Cyber-Forensics and Training Alliance, Neustar, Spamhaus, Team Cymru, Trend Micro, and the University of Alabama at Birmingham. The website for the DCWG, http://www.dcwg.org, is hosted at the Georgia Institute of Technology, under a research grant provided by the Office of Naval Research. The DCWG provides a quick method for users to determine whether or not their computers are infected with the DNS Changer malware. According to the DCWG, there are still 350,000 computers infected by the DNS Changer malware that are using the clean servers maintained by the DCWG which replaced the Rove Digital servers.

In order to quickly and safely test if a computer has been hijacked by the DNS Changer malware, the DCWG has created 11 international servers which will report back to the user if his computer is indeed hijacked by DNS Changer; in the U.S. the link for this test is http://www.dns-ok.us. The test can be run from any browser, and nothing is downloaded or installed on the computer during the test; it is simply a test to see if the computer is connecting to a correct IP address. The results are almost instantaneous, with a "DNS Changer Check Up" result displayed in an IP graphic; if it is green, the user is possibly free of the DNS Changer malware, but the green graphic does not certainly prove that the computer is clean. When the green display appears, it also says, " Your computer appears to be looking up IP addresses correctly! Had your computer been infected with DNS changer malware you would have seen a red background. Please note, however, that if your ISP is redirecting DNS traffic for its customers you would have reached this site even though you are infected." If the display is red, then it is likely that the computer is one of the many that have been compromised by DNS Changer.

For the computer that is "red", it will be necessary to clean the DNS Changer malware and then reset your DNS. Most of the current anti-spyware products such as the free versions of SuperAntiSpyware (http://www.superantispyware.com) and the free version of MalwareBytes (malwarebytes.org/products/malwarebytes_free) can detect and remove the DNS Changer malware, but it will still be necessary to reset your DNS in order for the internet to properly function on your computer.

Almost all ISP's (Internet Service Providers) offer telephone support that will help the user reset the DNS to the ISP's preferred DNS server. Gizmo's TechSupportAlert has instructions and links on how to find the best DNS server for you (techsupportalert.com/content/how-find-best-dns-server.htm), as well as detailed instructions on how to change or reset the DNS settings on your computer (techsupportalert.com/content/how-change-dns-server.htm).

Google has a free DNS utility "Namebench" at code.google.com/p/namebench that can help the user find the fastest free DNS, with instructions on how to change your DNS at developers.google.com/speed/public-dns/docs/using . Another excellent DNS service, OpenDNS, has simple but detailed instructions on how to change your DNS at use.opendns.com. If you use Google's Namebench to find the best combination of DNS for your computer and connection, you can use those DNS on your computer by following the instructions given on Google or OpenDNS on how to change your DNS settings; while the default DNS listed on the Google and OpenDNS instructions are excellent and totally adequate, there may be some performance improvement by using the DNS recommended by Namebench. You can always change them again later.

If you enjoy or depend on the internet, it is imperative that you go to http://www.dcwg.org/detect and see if your browser is connecting to a legitimate DNS. If the results are "green" you are likely (but not certainly) safe from the DNS Changer Trojan, and can probably continue to use the internet after July 9. If you are "red" you must clean your computer of the DNS Changer malware and reset your DNS as instructed above. Regardless of "green" or "red" results, it is always a good practice to periodically scan your computer with a good third-party utility such as SuperAntiSpyware or MalwareBytes to verify that nothing slipped by your security software. Failure to check your computer prior to July 9 may mean no internet for you on July 10.


Click here to return to top
====================================================================

==================================================================