Are you infected with the DNSChanger malware?

George Bagropoulos — Sat, 09 Jun 2012 16:58:13 +0000

What is DNS?

Domain Name Service (DNS) is an Internet Service that converts user friendly domain names into IP addresses that computers use eto identify each other on the Internet. For example www.talesfromthebits.com is the user friendly name. The IP is 174.132.189.253. It is much easier to remember the name than the IP address!

What DNSChanger malware is doing to my computer?

Criminals learned that by controlling the user’s DNS they can control what sites the user visits on the Internet. They can create fake web sites and redirect the unsuspected user to these sites in order to gather personal information or to display fraudulent web sites or to install silently more malicious software to the user’s computer. The FBI has uncovered a network of rogue DNS servers and has taken steps to disable it.

On July the 9th 2012 the servers will be shut down. If your computer is affected you may loose Internet connectivity. To check if your computer is affected or not click here.

Details of major DNS flow

George Bagropoulos — Thu, 24 Jul 2008 09:53:00 +0000

On July 21, Zynamics.com CEO Thomas Dullien (aka Halvar Flake) made a guess about the bug, admitting that he knew very little about DNS, but his findings were quickly confirmed by Matasano Security, a vendor that had been briefed on the issue.[2] According to Matasano Security, which briefly published the details of the security hole in its blog, an attacker with a fast internet connection would only need 10 seconds to carry out such an attack. The blog entry has since been removed – even from the Google cache. [1]
“The cat is out of the bag. Yes, Halvar Flake figured out the flaw Dan Kaminsky will announce at Black Hat.” Matasano said in a blog posting that was removed within five minutes. You can find the original post here.
An attacker could use a fast Internet connection to launch what is known as a DNS cache poisoning attack against a Domain Name server and succeed, for example, in redirecting traffic to malicious Web sites within about 10 seconds. [2]

References
[1] http://www.heise.de/english/newsticker/news/113228
[2] Robert McMillan, 2008, Details of major Internet flaw posted by accident Available at: http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=spam__malware_and_vulnerabilities&articleId=9110418&taxonomyId=85

DNS – Tales from the bits

Are you infected with the DNSChanger malware?

Details of major DNS flow