DNSChanger: Difference between revisions
KolbertBot (talk | contribs) m Bot: HTTP→HTTPS |
m →top |
||
Line 1: | Line 1: | ||
'''DNSChanger''' is still a [[DNS hijacking]] [[Trojan horse (computing)|Trojan]] from 2006 until now.<ref>http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=trojan:win32/dnschanger</ref><ref>https://www.virustotal.com/en/file/fdde13872caa1a0e1b9331188ca93b8fc424fed43d86d5cf53f6965f6a77184e/analysis/</ref> The work of an Estonian company known as [[Rove Digital]], the malware infected computers by modifying a computer's [[Domain Name System|DNS]] entries to point toward its own [[DNS_hijacking#Rogue_DNS_server|rogue]] [[name server]]s, which then injected its own advertising into Web pages. At its peak, DNSChanger was estimated to have infected over 4 million computers, bringing in at least [[United States dollar|US$]]14 million in profits to its operator from fraudulent advertising revenue.<ref name="ars-massive"/> |
'''DNSChanger''' is still a [[DNS hijacking]] [[Trojan horse (computing)|Trojan]] from 2006 until now.<ref>[http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=trojan:win32/dnschanger Trojan:Win32/Dnschanger]</ref><ref>[https://www.virustotal.com/en/file/fdde13872caa1a0e1b9331188ca93b8fc424fed43d86d5cf53f6965f6a77184e/analysis/ Antivirus scan for fdde13872caa1a0e1b9331188ca93b8fc424fed43d86d5cf53f6965f6a77184e]</ref> The work of an Estonian company known as [[Rove Digital]], the malware infected computers by modifying a computer's [[Domain Name System|DNS]] entries to point toward its own [[DNS_hijacking#Rogue_DNS_server|rogue]] [[name server]]s, which then injected its own advertising into Web pages. At its peak, DNSChanger was estimated to have infected over 4 million computers, bringing in at least [[United States dollar|US$]]14 million in profits to its operator from fraudulent advertising revenue.<ref name="ars-massive"/> |
||
Both [[Microsoft Windows|Windows]] and [[Mac OS X]] variants of DNSChanger were circulated, the latter taking the form of a related Trojan known as [[RSPlug]] |
Both [[Microsoft Windows|Windows]] and [[Mac OS X]] variants of DNSChanger were circulated, the latter taking the form of a related Trojan known as [[RSPlug]] |
||
The FBI raided the malicious servers on November 8, 2011.<ref>http://blog.trendmicro.com/trendlabs-security-intelligence/esthost-taken-down-biggest-cybercriminal-takedown-in-history/</ref> but they kept the servers up after they captured it to avoid affected users from losing internet access until July 9, 2012. |
The FBI raided the malicious servers on November 8, 2011.<ref>http://blog.trendmicro.com/trendlabs-security-intelligence/esthost-taken-down-biggest-cybercriminal-takedown-in-history/</ref> but they kept the servers up after they captured it to avoid affected users from losing internet access until July 9, 2012. |
||
==Operation== |
==Operation== |
||
DNSChanger was distributed as a [[drive-by download]] claiming to be a [[video codec]] needed to view content on a Web site, particularly appearing on rogue [[Internet pornography|pornography site]]s. Once installed, the malware then modified the system's [[Domain Name System]] (DNS) configuration, pointing them to rogue [[name server]]s operated through affiliates of Rove Digital.<ref name="ars-massive"/> These rogue name servers primarily substituted [[Internet marketing|advertising]] on Web pages with advertising sold by Rove. Additionally, the rogue DNS server [[Clickjacking|redirected links]] to certain Web sites to those of advertisers, such as for example, redirecting the [[Internal Revenue Service|IRS]] Web site to that of a [[tax preparation]] company.<ref name=pcworld-dontlose/> The effects of DNSChanger could also spread itself to other computers within a [[Local area network|LAN]] by mimicking a [[DHCP]] server, pointing other computers toward the rogue DNS servers.<ref name=pcworld-dontlose/> In its indictment against Rove, the [[United States Department of Justice]] also reported that the rogue servers had blocked access to update servers for [[antivirus software]].<ref name=ars-sevencharged/> |
DNSChanger was distributed as a [[drive-by download]] claiming to be a [[video codec]] needed to view content on a Web site, particularly appearing on rogue [[Internet pornography|pornography site]]s. Once installed, the malware then modified the system's [[Domain Name System]] (DNS) configuration, pointing them to rogue [[name server]]s operated through affiliates of Rove Digital.<ref name="ars-massive"/> These rogue name servers primarily substituted [[Internet marketing|advertising]] on Web pages with advertising sold by Rove. Additionally, the rogue DNS server [[Clickjacking|redirected links]] to certain Web sites to those of advertisers, such as for example, redirecting the [[Internal Revenue Service|IRS]] Web site to that of a [[tax preparation]] company.<ref name=pcworld-dontlose/> The effects of DNSChanger could also spread itself to other computers within a [[Local area network|LAN]] by mimicking a [[DHCP]] server, pointing other computers toward the rogue DNS servers.<ref name=pcworld-dontlose/> In its indictment against Rove, the [[United States Department of Justice]] also reported that the rogue servers had blocked access to update servers for [[antivirus software]].<ref name=ars-sevencharged/> |
Revision as of 08:30, 16 October 2017
DNSChanger is still a DNS hijacking Trojan from 2006 until now.[1][2] The work of an Estonian company known as Rove Digital, the malware infected computers by modifying a computer's DNS entries to point toward its own rogue name servers, which then injected its own advertising into Web pages. At its peak, DNSChanger was estimated to have infected over 4 million computers, bringing in at least US$14 million in profits to its operator from fraudulent advertising revenue.[3]
Both Windows and Mac OS X variants of DNSChanger were circulated, the latter taking the form of a related Trojan known as RSPlug
The FBI raided the malicious servers on November 8, 2011.[4] but they kept the servers up after they captured it to avoid affected users from losing internet access until July 9, 2012.
Operation
DNSChanger was distributed as a drive-by download claiming to be a video codec needed to view content on a Web site, particularly appearing on rogue pornography sites. Once installed, the malware then modified the system's Domain Name System (DNS) configuration, pointing them to rogue name servers operated through affiliates of Rove Digital.[3] These rogue name servers primarily substituted advertising on Web pages with advertising sold by Rove. Additionally, the rogue DNS server redirected links to certain Web sites to those of advertisers, such as for example, redirecting the IRS Web site to that of a tax preparation company.[5] The effects of DNSChanger could also spread itself to other computers within a LAN by mimicking a DHCP server, pointing other computers toward the rogue DNS servers.[5] In its indictment against Rove, the United States Department of Justice also reported that the rogue servers had blocked access to update servers for antivirus software.[6]
Shutdown and interim DNS servers
On October 1, 2011, as part of Operation Ghost Click (a collaborative investigation into the operation), the United States Attorney for the Southern District of New York announced charges against six Estonian nationals and one Russian national connected to DNSChanger and Rove Digital for wire fraud, computer intrusion, and conspiracy.[6] Arrests were made by Estonian authorities, and servers connected to the malware located in the United States were seized by the FBI.[3]
Due to concerns by FBI agents that users still infected by DNSChanger could lose Internet access if the rogue DNS servers were shut down entirely, a temporary court order was obtained to allow the Internet Systems Consortium to operate replacement servers, which would serve DNS requests from those who had not yet removed the infection, and to collect information on those still infected in order to promptly notify them about the presence of the malware.[7] While the court order was set to expire on March 8, 2012, an extension was granted until July 9, 2012 due to concerns that there were still many infected computers.[5] F-Secure estimated on July 4, 2012 that at least 300,000 computers were still infected with the DNSChanger malware, 70,000 of which were located in the United States. [8] The interim DNS servers were officially shut down by the FBI on July 9, 2012.[9]
Impact from the shutdown was considered to be minimal, due in part to major Internet service providers providing temporary DNS services of their own and support to customers affected by DNSChanger. and informational campaigns surrounding the malware and the impending shutdown. These included online tools that could check for the presence of DNSChanger, while Google and Facebook provided notifications to visitors of their respective services who were still affected by the malware.[8] By July 9, 2012, F-Secure estimated that the number of remaining DNSChanger infections in the U.S. had dropped from 70,000 to 42,000.[9]
References
- ^ Trojan:Win32/Dnschanger
- ^ Antivirus scan for fdde13872caa1a0e1b9331188ca93b8fc424fed43d86d5cf53f6965f6a77184e
- ^ a b c "How the most massive botnet scam ever made millions for Estonian hackers". Ars Technica. Retrieved 6 July 2012.
- ^ http://blog.trendmicro.com/trendlabs-security-intelligence/esthost-taken-down-biggest-cybercriminal-takedown-in-history/
- ^ a b c "Don't Lose the Internet in July! FBI Repeats DNSChanger Warning". PC World. Retrieved 6 July 2012.
- ^ a b "Seven charged in malware-driven click fraud case". Ars Technica. Retrieved 6 July 2012.
- ^ "'DNSChanger' Malware Could Strand Thousands When Domains Go Dark on Monday". Wired. Retrieved 6 July 2012.
- ^ a b "Are You Infected With DNSChanger Malware?". PC World. Retrieved 6 July 2012.
- ^ a b "ISPs Report Minimal DNSChanger Impact". PC World. Retrieved 13 July 2012.
External links
- www.dcwg.org — DNS Changer Working Group; tools and information for diagnosing DNSChanger infections