Will Your Browser Go Dark on March 8?
- Jan 26, 2012 8:52 AM EST
- [num] Comments
First, it's important to understand what DNSChanger did. DNS, the Domain Name System, is what translates a human-readable domain name like www.pcmag.com into an IP address like 126.96.36.199. Browsers and other Internet-aware processes communicate using IP addresses, not domain names. The translation from one to the other is handled by DNS servers. Users don't usually have to worry about this, as DNS configuration can be automatic.
What DNSChanger did was subvert the process by tweaking the system's settings so that DNS requests would go to their own dishonest servers. When the victim tried to connect with a commercial website, the evil DNS servers would instead connect them with a fake site having an identical appearance. This isn't phishing; you can't detect it by making sure the address bar shows the desired domain. Typing the address yourself rather than clicking a link in email won't help either, not when DNS is compromised. Once you've made your "purchase" at the fraudulent site, the bad guys have your money—and they got away with $14 million before being shut down.
A Lingering Problem
When the FBI shut down DNSChanger, they replaced the rogue DNS servers with clean and correct servers, but that step did nothing to remove the DNSChanger malware. Even if your antivirus removed DNSChanger, it may not have undone all of its system changes. Sorin Mustaca, a researcher at Avira, points out that the FBI's move was temporary. On March 8, less than two months from now, they'll shut down the replacement servers entirely.
If you wake up on March 8 and find that your browser can't find any websites, it probably means your system has lingering traces of DNSChanger. But why wait? Mustaca's blog post explains how to determine whether your system is affected.
Yes, the FBI also offered a page to help with this problem. However, few users would know exactly how to respond to its terse instructions and the prompt "please type your DNS information into the search box below."
If by following Avira's advice you determine that you system is indeed afflicted, use Avira's free tool to fix the problem. Or… you can wait until March 8 and try to solve the problem without access to any helpful websites.
For more from Neil, follow him on Twitter @neiljrubenking.