Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/25/2012
01:59 PM
50%
50%

Avoid Net Shutdown Related To DNSChanger: SMB Tips

FBI will shut down servers associated with the DNSChanger malware on July 9, knocking 300,000-plus computers still affected offline. Here's what SMBs need to know.

The actual threat behind the DNSChanger malware lost its teeth late last year, but confusion could still reign for plenty of computer users come July 9.

More than 300,000 PCs remain infected, long after the FBI caught the bad guys and took control of the servers behind DNSChanger. That's in spite of public pleas for businesses and other computer users to take steps to ensure they won't suffer an Internet outage when the FBI shuts down the DNSChanger servers July 9. (Since nabbing the bad guys, the agency has been running "clean" servers that have allowed affected machines to connect to the Internet without issues.) Even Google starting pitching in last month, notifying users that appeared to be infected. The efforts haven't been for naught; the number of unique IP addresses communicating with the FBI servers peaked at more than 800,000 last November.

Small and midsize businesses (SMBs) that take a see-no-evil, hear-no-evil approach are vulnerable here because compromised machines require a modicum of manual effort to resolve. Antimalware programs might show the end user an (easily ignored) alert if it finds DNSChanger, but are unlikely to automatically restore the correct DNS settings. Symantec, for example, notes that its "products do not restore the DNS settings on a compromised computer because we have no way of knowing what the original settings were." Restoring DNS settings incorrectly could cause further issues.

[ Take a refresher course in SMB security. Read 5 Flame Security Lessons For SMBs. ]

The downside for SMB users that get knocked offline July 9 isn't particularly ominous, but it's potentially a giant pain in the you-know-what. That's because anyone who gets that far without knowing they're affected is also likely to not understand why they can suddenly no longer connect to the Internet.

"The business won't end, it won't implode, but there will be a significant cost as they try to figure this out," said Kevin Haley, director of Symantec Security Response, in an interview. "They'll go through a lot of different troubleshooting steps not realizing what the real issue is. There will be a lot of time wasted." Money might go down the drain, too, particularly at any SMB that calls in an outside IT consultant to help figure out why they suddenly can't get online.

There's plenty of good news, though. For starters, it's very easy to find out if your PC is among the machines that will lose Internet access July 9--just click here. If you're unaffected, you're done. That's it. If you are among the infected machines, the fix is relatively simple. You just need to restore your original DNS settings. (If that sounds like Greek, contact your Internet service provider or IT administrator to learn how to do so.) The DNSChanger Working Group has posted general instructions for fixing affected machines, too.

Don't expect an extension on the FBI's July 9 shutdown. Haley said the agency has done all it can to get the word out and that continuing to keep the servers up and running--which costs money, among other considerations--no longer make sense. It's time to pull the plug.

"They can't just keep doing it forever," Haley said. "At this point, I think if people don't become aware of it, they're never going to become aware of it. [Shutting down the servers] is probably the only thing that can be done at this point."

SMBs have saved big buying software on a subscription model. The new, all-digital Cloud Beyond SaaS issue of InformationWeek SMB shows how to determine if infrastructure services can pay off, too. Also in this issue: One startup's experience with infrastructure-as-a-service shows how the numbers stack up for IaaS vs. internal IT. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Bprince
50%
50%
Bprince,
User Rank: Ninja
7/1/2012 | 3:42:50 AM
re: Avoid Net Shutdown Related To DNSChanger: SMB Tips
This is a problem facing enterprises as well. Just recently IID reported that 12 percent of the Fortune 500 still had computers infected with DNSChanger. It's surprising that so many are still infected. The bottom line is people have to determine whether or not they are impacted and take advantage of the tools and advice that is out there for remediation.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Tell him only Kevin Mitnick and the President know the launch codes.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31607
PUBLISHED: 2021-04-23
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function...
CVE-2021-31597
PUBLISHED: 2021-04-23
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
CVE-2021-2296
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2297
PUBLISHED: 2021-04-22
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...
CVE-2021-2298
PUBLISHED: 2021-04-22
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attac...