Risk

6/25/2012
01:59 PM
50%
50%

Avoid Net Shutdown Related To DNSChanger: SMB Tips

FBI will shut down servers associated with the DNSChanger malware on July 9, knocking 300,000-plus computers still affected offline. Here's what SMBs need to know.

The actual threat behind the DNSChanger malware lost its teeth late last year, but confusion could still reign for plenty of computer users come July 9.

More than 300,000 PCs remain infected, long after the FBI caught the bad guys and took control of the servers behind DNSChanger. That's in spite of public pleas for businesses and other computer users to take steps to ensure they won't suffer an Internet outage when the FBI shuts down the DNSChanger servers July 9. (Since nabbing the bad guys, the agency has been running "clean" servers that have allowed affected machines to connect to the Internet without issues.) Even Google starting pitching in last month, notifying users that appeared to be infected. The efforts haven't been for naught; the number of unique IP addresses communicating with the FBI servers peaked at more than 800,000 last November.

Small and midsize businesses (SMBs) that take a see-no-evil, hear-no-evil approach are vulnerable here because compromised machines require a modicum of manual effort to resolve. Antimalware programs might show the end user an (easily ignored) alert if it finds DNSChanger, but are unlikely to automatically restore the correct DNS settings. Symantec, for example, notes that its "products do not restore the DNS settings on a compromised computer because we have no way of knowing what the original settings were." Restoring DNS settings incorrectly could cause further issues.

[ Take a refresher course in SMB security. Read 5 Flame Security Lessons For SMBs. ]

The downside for SMB users that get knocked offline July 9 isn't particularly ominous, but it's potentially a giant pain in the you-know-what. That's because anyone who gets that far without knowing they're affected is also likely to not understand why they can suddenly no longer connect to the Internet.

"The business won't end, it won't implode, but there will be a significant cost as they try to figure this out," said Kevin Haley, director of Symantec Security Response, in an interview. "They'll go through a lot of different troubleshooting steps not realizing what the real issue is. There will be a lot of time wasted." Money might go down the drain, too, particularly at any SMB that calls in an outside IT consultant to help figure out why they suddenly can't get online.

There's plenty of good news, though. For starters, it's very easy to find out if your PC is among the machines that will lose Internet access July 9--just click here. If you're unaffected, you're done. That's it. If you are among the infected machines, the fix is relatively simple. You just need to restore your original DNS settings. (If that sounds like Greek, contact your Internet service provider or IT administrator to learn how to do so.) The DNSChanger Working Group has posted general instructions for fixing affected machines, too.

Don't expect an extension on the FBI's July 9 shutdown. Haley said the agency has done all it can to get the word out and that continuing to keep the servers up and running--which costs money, among other considerations--no longer make sense. It's time to pull the plug.

"They can't just keep doing it forever," Haley said. "At this point, I think if people don't become aware of it, they're never going to become aware of it. [Shutting down the servers] is probably the only thing that can be done at this point."

SMBs have saved big buying software on a subscription model. The new, all-digital Cloud Beyond SaaS issue of InformationWeek SMB shows how to determine if infrastructure services can pay off, too. Also in this issue: One startup's experience with infrastructure-as-a-service shows how the numbers stack up for IaaS vs. internal IT. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
7/1/2012 | 3:42:50 AM
re: Avoid Net Shutdown Related To DNSChanger: SMB Tips
This is a problem facing enterprises as well. Just recently IID reported that 12 percent of the Fortune 500 still had computers infected with DNSChanger. It's surprising that so many are still infected. The bottom line is people have to determine whether or not they are impacted and take advantage of the tools and advice that is out there for remediation.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2607
PUBLISHED: 2018-05-21
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users...
CVE-2018-1108
PUBLISHED: 2018-05-21
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
CVE-2018-11330
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
CVE-2018-11331
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
CVE-2018-7687
PUBLISHED: 2018-05-21
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.