FBI: Hundreds Of Thousands May Lose Internet In July

[wraith808]

For computer users, a few mouse clicks could mean the difference between staying online and losing Internet connections this summer.

Unknown to most of them, their problem began when international hackers ran an online advertising scam to take control of infected computers around the world. In a highly unusual response, the FBI set up a safety net months ago using government computers to prevent Internet disruptions for those infected users. But that system is to be shut down.

The FBI is encouraging users to visit a website run by its security partner, http://www.dcwg.org , that will inform them whether they're infected and explain how to fix the problem. After July 9, infected users won't be able to connect to the Internet.

continued at http://www.huffingto...-july_n_1441260.html

more info at http://www.fbi.gov/n...ember/malware_110911

I'd not heard of this... anyone else hear anything about it?  I did have the (admittedly) paranoid thought that this might be something else totally, especially in light of the recent activities by the FBI, i.e. MegaUpload...

[daddydave]

That same FBI link showed up in my Facebook stream recently. Sounds like yet another reason to run Ad Blocker.

[mwb1100]

I'd not heard of this... anyone else hear anything about it?

-wraith808 (April 23, 2012, 10:13 PM)

I just read about this in the local paper a couple days ago,and at first I thought the paper had been fooled by a hoax story.  But it's legit (the FBI link you gave has a really good explanation). 

The tl;dr version:

  - criminals used malware to change the DNS settings on computers to point to their own DNS servers.  At that point that crime ring effectively controlled what your computer connected to on the Internet.
  - the FBI (or other law enforcement) took down the crime ring, and replaced the rogue DNS servers with 'legit' ones
  - the FBI will stop running those 'legit' DNS servers on July 9, so if your computer was compromised, it won't work very well on the Internet after that

[Stoic Joker]

Nice, so instead of informing the public about the exploit ...So they could get it fixed properly... The Feds decide to perpetuate it (by piping it through their own servers) for what exactly?? Sounds to me like a bunch of folks just got hacked once and then sold off for chattel by their "rescuers".

[mwb1100]

Nice, so instead of informing the public about the exploit ...So they could get it fixed properly... The Feds decide to perpetuate it (by piping it through their own servers) for what exactly?? Sounds to me like a bunch of folks just got hacked once and then sold off for chattel by their "rescuers".

-Stoic Joker (April 24, 2012, 06:43 AM)

I don't think that's the way I'd describe what happened.

  -  They have informed the public (whether they've done so effectively might be debatable).

  -  The replacements for the rogue DNS servers were set up so people who were exploited could continue using the internet.  I think another reason was to give time for Microsoft, ISPs and anti-malware vendors to get fixes through to their users. I'd hope that that was being done, but don't know if it was. Nobody could force them to do so.

I suppose there could be additional nefarious purposes, but I don't think there is. And if there were, on July 9 it goes away so at least there's a time limit on it.

[tomos]

I heard about this (via a german site) a while back, and checked (I think, again, via a german site) if I was okay or not.
Sorry, I have no links / cant remember where...

[Deozaan]

I use OpenDNS, so I think I should be good.

[Stoic Joker]

Nice, so instead of informing the public about the exploit ...So they could get it fixed properly... The Feds decide to perpetuate it (by piping it through their own servers) for what exactly?? Sounds to me like a bunch of folks just got hacked once and then sold off for chattel by their "rescuers".

-Stoic Joker (April 24, 2012, 06:43 AM)

I don't think that's the way I'd describe what happened.

-mwb1100 (April 25, 2012, 02:10 AM)

(hehe) Understood. But I'm a product of the 70's ... So I've never really been warm-and-fuzzy with "the man".

 -  They have informed the public (whether they've done so effectively might be debatable).

  -  The replacements for the rogue DNS servers were set up so people who were exploited could continue using the internet.  I think another reason was to give time for Microsoft, ISPs and anti-malware vendors to get fixes through to their users. I'd hope that that was being done, but don't know if it was. Nobody could force them to do so.

-mwb1100 (April 25, 2012, 02:10 AM)

Agreed, but... It just strikes me that they stumbled across a "sweet spot" demographic and decided to mine it for awhile to see what else might show-up regarding the target audience. Otherwise what would be the point of treating this particular bugg any different than the other thousands of exploits floating around out there? People might lose internet access? Like that doesn't happen every day anyhow...

The DNS servers were changed, that's hardly a rocket science level fix. Redirection folks to a page that said "Hi we're the Feds, and you're infected with X. Please contact you're ISP or local computer emporium for a fix." would have been considerably more honest. OTOH Expecting me to believe those (FBI DNS) servers didn't have logging set to max ...(lol)... Just ain't gonna happen.

[Renegade]

Seems to me that the FBI needs a good EMP so we can watch them go WTF as they are KO'd.