DNSChanger server shutdown on Monday didn't cause a significant disruption, but the danger is not over yet, security experts say.
When the FBI on Monday shut down the temporary DNS servers keeping users infected with the DNSChanger Trojan online, only a tiny fraction of users still harbored the malware and some ISPs had established their own DNS backup servers for those stragglers.
All in all, the damage was minimal: just over 210,000 unique IP victims around the globe--a far cry from the initial headcount of millions of victims hit by the nasty malware--still remain infected with the malware, even after aggressive campaigns by many ISPs to alert users and offer them help to clean up their machines.
But the threat is far from over, security experts say.
Paul Vixie, chairman and founder of the Internet Security Consortium (ISC), which actually ran and managed the servers on behalf of the FBI operation, says by pulling the BandAid off slowly and keeping infected users from losing their DNS, ISPs are only masking the danger to victims. "The idea is to rip it [the BandAid] off" instead, he says.
Black Hat USA Las Vegas, the premiere conference on information security, features four days of deep technical training followed by two days of presentations from speakers discussing their latest research around a broad range of security topics. At Caesars Palace in Las Vegas, July 21-26. Register today.
Published: 2014-04-23 Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.
Published: 2014-04-23 The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.
Published: 2014-04-23 Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.
Published: 2014-04-23 Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.
Published: 2014-04-23 Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.