Risk
6/25/2012
01:59 PM
Connect Directly
RSS
E-Mail
50%
50%

Avoid Net Shutdown Related To DNSChanger: SMB Tips

FBI will shut down servers associated with the DNSChanger malware on July 9, knocking 300,000-plus computers still affected offline. Here's what SMBs need to know.

The actual threat behind the DNSChanger malware lost its teeth late last year, but confusion could still reign for plenty of computer users come July 9.

More than 300,000 PCs remain infected, long after the FBI caught the bad guys and took control of the servers behind DNSChanger. That's in spite of public pleas for businesses and other computer users to take steps to ensure they won't suffer an Internet outage when the FBI shuts down the DNSChanger servers July 9. (Since nabbing the bad guys, the agency has been running "clean" servers that have allowed affected machines to connect to the Internet without issues.) Even Google starting pitching in last month, notifying users that appeared to be infected. The efforts haven't been for naught; the number of unique IP addresses communicating with the FBI servers peaked at more than 800,000 last November.

Small and midsize businesses (SMBs) that take a see-no-evil, hear-no-evil approach are vulnerable here because compromised machines require a modicum of manual effort to resolve. Antimalware programs might show the end user an (easily ignored) alert if it finds DNSChanger, but are unlikely to automatically restore the correct DNS settings. Symantec, for example, notes that its "products do not restore the DNS settings on a compromised computer because we have no way of knowing what the original settings were." Restoring DNS settings incorrectly could cause further issues.

[ Take a refresher course in SMB security. Read 5 Flame Security Lessons For SMBs. ]

The downside for SMB users that get knocked offline July 9 isn't particularly ominous, but it's potentially a giant pain in the you-know-what. That's because anyone who gets that far without knowing they're affected is also likely to not understand why they can suddenly no longer connect to the Internet.

"The business won't end, it won't implode, but there will be a significant cost as they try to figure this out," said Kevin Haley, director of Symantec Security Response, in an interview. "They'll go through a lot of different troubleshooting steps not realizing what the real issue is. There will be a lot of time wasted." Money might go down the drain, too, particularly at any SMB that calls in an outside IT consultant to help figure out why they suddenly can't get online.

There's plenty of good news, though. For starters, it's very easy to find out if your PC is among the machines that will lose Internet access July 9--just click here. If you're unaffected, you're done. That's it. If you are among the infected machines, the fix is relatively simple. You just need to restore your original DNS settings. (If that sounds like Greek, contact your Internet service provider or IT administrator to learn how to do so.) The DNSChanger Working Group has posted general instructions for fixing affected machines, too.

Don't expect an extension on the FBI's July 9 shutdown. Haley said the agency has done all it can to get the word out and that continuing to keep the servers up and running--which costs money, among other considerations--no longer make sense. It's time to pull the plug.

"They can't just keep doing it forever," Haley said. "At this point, I think if people don't become aware of it, they're never going to become aware of it. [Shutting down the servers] is probably the only thing that can be done at this point."

SMBs have saved big buying software on a subscription model. The new, all-digital Cloud Beyond SaaS issue of InformationWeek SMB shows how to determine if infrastructure services can pay off, too. Also in this issue: One startup's experience with infrastructure-as-a-service shows how the numbers stack up for IaaS vs. internal IT. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
7/1/2012 | 3:42:50 AM
re: Avoid Net Shutdown Related To DNSChanger: SMB Tips
This is a problem facing enterprises as well. Just recently IID reported that 12 percent of the Fortune 500 still had computers infected with DNSChanger. It's surprising that so many are still infected. The bottom line is people have to determine whether or not they are impacted and take advantage of the tools and advice that is out there for remediation.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-4988
Published: 2014-07-09
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

CVE-2014-0207
Published: 2014-07-09
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

CVE-2014-0537
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-0539
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-3309
Published: 2014-07-09
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.