Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/25/2012
01:59 PM
50%
50%

Avoid Net Shutdown Related To DNSChanger: SMB Tips

FBI will shut down servers associated with the DNSChanger malware on July 9, knocking 300,000-plus computers still affected offline. Here's what SMBs need to know.

The actual threat behind the DNSChanger malware lost its teeth late last year, but confusion could still reign for plenty of computer users come July 9.

More than 300,000 PCs remain infected, long after the FBI caught the bad guys and took control of the servers behind DNSChanger. That's in spite of public pleas for businesses and other computer users to take steps to ensure they won't suffer an Internet outage when the FBI shuts down the DNSChanger servers July 9. (Since nabbing the bad guys, the agency has been running "clean" servers that have allowed affected machines to connect to the Internet without issues.) Even Google starting pitching in last month, notifying users that appeared to be infected. The efforts haven't been for naught; the number of unique IP addresses communicating with the FBI servers peaked at more than 800,000 last November.

Small and midsize businesses (SMBs) that take a see-no-evil, hear-no-evil approach are vulnerable here because compromised machines require a modicum of manual effort to resolve. Antimalware programs might show the end user an (easily ignored) alert if it finds DNSChanger, but are unlikely to automatically restore the correct DNS settings. Symantec, for example, notes that its "products do not restore the DNS settings on a compromised computer because we have no way of knowing what the original settings were." Restoring DNS settings incorrectly could cause further issues.

[ Take a refresher course in SMB security. Read 5 Flame Security Lessons For SMBs. ]

The downside for SMB users that get knocked offline July 9 isn't particularly ominous, but it's potentially a giant pain in the you-know-what. That's because anyone who gets that far without knowing they're affected is also likely to not understand why they can suddenly no longer connect to the Internet.

"The business won't end, it won't implode, but there will be a significant cost as they try to figure this out," said Kevin Haley, director of Symantec Security Response, in an interview. "They'll go through a lot of different troubleshooting steps not realizing what the real issue is. There will be a lot of time wasted." Money might go down the drain, too, particularly at any SMB that calls in an outside IT consultant to help figure out why they suddenly can't get online.

There's plenty of good news, though. For starters, it's very easy to find out if your PC is among the machines that will lose Internet access July 9--just click here. If you're unaffected, you're done. That's it. If you are among the infected machines, the fix is relatively simple. You just need to restore your original DNS settings. (If that sounds like Greek, contact your Internet service provider or IT administrator to learn how to do so.) The DNSChanger Working Group has posted general instructions for fixing affected machines, too.

Don't expect an extension on the FBI's July 9 shutdown. Haley said the agency has done all it can to get the word out and that continuing to keep the servers up and running--which costs money, among other considerations--no longer make sense. It's time to pull the plug.

"They can't just keep doing it forever," Haley said. "At this point, I think if people don't become aware of it, they're never going to become aware of it. [Shutting down the servers] is probably the only thing that can be done at this point."

SMBs have saved big buying software on a subscription model. The new, all-digital Cloud Beyond SaaS issue of InformationWeek SMB shows how to determine if infrastructure services can pay off, too. Also in this issue: One startup's experience with infrastructure-as-a-service shows how the numbers stack up for IaaS vs. internal IT. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
7/1/2012 | 3:42:50 AM
re: Avoid Net Shutdown Related To DNSChanger: SMB Tips
This is a problem facing enterprises as well. Just recently IID reported that 12 percent of the Fortune 500 still had computers infected with DNSChanger. It's surprising that so many are still infected. The bottom line is people have to determine whether or not they are impacted and take advantage of the tools and advice that is out there for remediation.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...