Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Google Spreads Word On DNSChanger Malware

After taking down the botnet, the FBI is still trying to alert 500,000 people that their PCs are infected with the malware. Some Google search users are now getting direct warnings.

"Your computer appears to be infected."

Google began displaying that message Tuesday to anyone using one of its search engine sites with a PC that appears to be infected with the DNSChanger malware.

"After successfully alerting a million users last summer to a different type of malware, we've replicated this method and have started showing warnings via a special message that will appear at the top of the Google search results page for users with affected devices," said Google security engineer Damian Menscher in a blog post. The previous effort targeted a fake antivirus software campaign.

[ Read about some real-world examples of mobile malware and the challenges of thwarting them. See 6 Findings That Prove Mobile Malware's Mettle. ]

"Our goal with this notification is to raise awareness of DNSChanger among affected users," Menscher said. Furthermore, since about half of infected PCs appear to be located in non-English-speaking countries, "we believe directly messaging affected users on a trusted site and in their preferred language will produce the best possible results."

Why the proactivity with respect to this particular piece of malware? Because any PC infected by DNSChanger stands to lose Internet access on July 9, 2012. That's the court-ordered date for the FBI and the Internet Systems Consortium to disconnect the domain name system (DNS) servers they're currently using to resolve Internet addresses for PCs infected by DNSChanger. The FBI commissioned the servers after "Operation Ghost Click," in which the bureau and Estonian police worked together to bust six Estonians for using the malware to conduct a four-year click fraud campaign that raked in an estimated $14 million.

To perpetrate the click fraud--forcing a Web browser to "click" on certain advertisements, thus generating revenue from pay-per-impression advertising networks or referral fees--the criminals used their malware to alter the DNS settings on infected PCs to their own rogue DNS servers. Even after the botnet operators were arrested, however, the infected PCs were still relying on the rogue DNS servers to resolve domain names into IP addresses.

For anyone left with a PC infected by DNSChanger come July 9, when the temporary DNS server gets disconnected, the resulting loss of connectivity may not be easy to diagnose. "In the simplest terms, connectivity will not be severed for DNSChanger-infected systems, but Internet communications will not function for infected systems that have not been cleaned up," explained Kurt Baumgartner, senior security researcher for the global research and analysis team at Kaspersky Lab, via Threatpost. "In the U.S., government agencies, home users, and other organizations still infected with the malware will have systems that effectively can't get online, can't send email, etc. It will look like they are connected to their network, but they just won't communicate with anything."

Google's outreach effort alone, of course, won't solve this malware-infection problem. "While we expect to notify over 500,000 users within a week, we realize we won't reach every affected user," said Menscher. Still, reducing the number of infections by any amount will help. "If more devices are cleaned and steps are taken to better secure the machines against further abuse, the notification effort will be well worth it," he said.

Since the botnet takedown, numerous service providers--including AT&T, Bell Canada, CenturyLink, Comcast, COX, Time Warner, and Verizon--have also begun notifying customers whose PCs that appear to be infected. Meanwhile, for anyone else who suspects their PC may have been infected, the DNSChanger Working Group (DCWG) also maintains a list of websites that will identify if your PC is carrying the malware.

When it comes to regulatory compliance, auditors consider more than how you protect your company's covered assets from external attackers. In the Compliance From The Inside Out report, we show you how to create and implement a security program that will defend against malicious and inadvertent internal incidents and satisfy government and industry mandates. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22675
PUBLISHED: 2021-05-07
The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attacker to remotely execute code on SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, C...
CVE-2021-22679
PUBLISHED: 2021-05-07
The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK v...
CVE-2020-14009
PUBLISHED: 2021-05-07
Proofpoint Enterprise Protection (PPS/PoD) before 8.17.0 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipar...
CVE-2021-21984
PUBLISHED: 2021-05-07
VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance.
CVE-2021-26122
PUBLISHED: 2021-05-07
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.