Risk
6/25/2012
01:59 PM
50%
50%

Avoid Net Shutdown Related To DNSChanger: SMB Tips

FBI will shut down servers associated with the DNSChanger malware on July 9, knocking 300,000-plus computers still affected offline. Here's what SMBs need to know.

The actual threat behind the DNSChanger malware lost its teeth late last year, but confusion could still reign for plenty of computer users come July 9.

More than 300,000 PCs remain infected, long after the FBI caught the bad guys and took control of the servers behind DNSChanger. That's in spite of public pleas for businesses and other computer users to take steps to ensure they won't suffer an Internet outage when the FBI shuts down the DNSChanger servers July 9. (Since nabbing the bad guys, the agency has been running "clean" servers that have allowed affected machines to connect to the Internet without issues.) Even Google starting pitching in last month, notifying users that appeared to be infected. The efforts haven't been for naught; the number of unique IP addresses communicating with the FBI servers peaked at more than 800,000 last November.

Small and midsize businesses (SMBs) that take a see-no-evil, hear-no-evil approach are vulnerable here because compromised machines require a modicum of manual effort to resolve. Antimalware programs might show the end user an (easily ignored) alert if it finds DNSChanger, but are unlikely to automatically restore the correct DNS settings. Symantec, for example, notes that its "products do not restore the DNS settings on a compromised computer because we have no way of knowing what the original settings were." Restoring DNS settings incorrectly could cause further issues.

[ Take a refresher course in SMB security. Read 5 Flame Security Lessons For SMBs. ]

The downside for SMB users that get knocked offline July 9 isn't particularly ominous, but it's potentially a giant pain in the you-know-what. That's because anyone who gets that far without knowing they're affected is also likely to not understand why they can suddenly no longer connect to the Internet.

"The business won't end, it won't implode, but there will be a significant cost as they try to figure this out," said Kevin Haley, director of Symantec Security Response, in an interview. "They'll go through a lot of different troubleshooting steps not realizing what the real issue is. There will be a lot of time wasted." Money might go down the drain, too, particularly at any SMB that calls in an outside IT consultant to help figure out why they suddenly can't get online.

There's plenty of good news, though. For starters, it's very easy to find out if your PC is among the machines that will lose Internet access July 9--just click here. If you're unaffected, you're done. That's it. If you are among the infected machines, the fix is relatively simple. You just need to restore your original DNS settings. (If that sounds like Greek, contact your Internet service provider or IT administrator to learn how to do so.) The DNSChanger Working Group has posted general instructions for fixing affected machines, too.

Don't expect an extension on the FBI's July 9 shutdown. Haley said the agency has done all it can to get the word out and that continuing to keep the servers up and running--which costs money, among other considerations--no longer make sense. It's time to pull the plug.

"They can't just keep doing it forever," Haley said. "At this point, I think if people don't become aware of it, they're never going to become aware of it. [Shutting down the servers] is probably the only thing that can be done at this point."

SMBs have saved big buying software on a subscription model. The new, all-digital Cloud Beyond SaaS issue of InformationWeek SMB shows how to determine if infrastructure services can pay off, too. Also in this issue: One startup's experience with infrastructure-as-a-service shows how the numbers stack up for IaaS vs. internal IT. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
7/1/2012 | 3:42:50 AM
re: Avoid Net Shutdown Related To DNSChanger: SMB Tips
This is a problem facing enterprises as well. Just recently IID reported that 12 percent of the Fortune 500 still had computers infected with DNSChanger. It's surprising that so many are still infected. The bottom line is people have to determine whether or not they are impacted and take advantage of the tools and advice that is out there for remediation.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.