Search, View and Navigation
Mailing List
[SingCERT] DNSChanger Clean DNS Servers Will Be Shut Down On 9 July 2012
Last Updated on Friday, 30 March 2012 15:19
[ Summary ]
In an operation known as Operation Ghost Click last year, US authorities investigated and arrested people who are allegedly involved in infecting millions of computers with a malware strain known as “DNSChanger”.
Users whose computers are infected are currently being directed to these servers maintained by the ISC. This arrangement will expire on 9 July 2012, and computers which are still infected may lose internet connectivity when the servers are turned off.
[ Background ]
DNSChanger is a malware that changes a user’s Domain Name System (DNS) settings, which enables criminals to direct unsuspecting users to fraudulent websites and interfere with their web browsing activities.
In November 2011, the FBI shut down a ring of cyber criminals believed to be involved in the spreading of DNSChanger malware. Four million users are estimated to be affected worldwide.
To avoid disruptions to users’ internet connectivity, the FBI have obtained a court order to authorize ISC to temporary maintain the DNS servers to allow users to clean their computers and restore their DNS settings.
On 9 July 2012, the clean DNS servers operated by Internet Systems Consortium (ISC) will be turned off.
[ Signs of Infection ]
The computer and/or router’s DNS server settings are pointing to servers from the following IP address ranges:
85.255.112.0 to 85.255.127.255
67.210.0.0 to 67.210.15.255
93.188.160.0 to 93.188.167.255
77.67.83.0 to 77.67.83.255
213.109.64.0 to 213.109.79.255
67.28.176.0 to 64.28.191.255
One may also check if he is affected by DNSChanger by visiting one of the following sites:
https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS
[ Resolution ]
Windows users may follow the cleanup instructions provided by the DNSChanger Working Group (DCWG) below.
http://www.dcwg.org/cleanup.html
Mac users may use a cleanup tool provided by SecureMac.
http://www.securemac.com/dnschanger-bulletin.php
Router’s DNS server settings will need to be updated and secured after the computer has been cleaned up.
Detailed instructions for updating the DNS server settings and securing the router can be found in the manual provided by the manufacturer.
[ Prevention ]
Following are some tips to prevent infections in future:
- Install and keep anti-malware software up-to-date
- Install a personal firewall software
- Enable automatic updates on the operating system to keep it up-to-date
- Keep web browsers up-to-date and enable its security functions
- Set strong passwords and change them regularly
- Use a limited rights account for routine activities such as web browsing and reading of emails
- Exercise caution when clicking on links or email attachments
- Backup information regularly to another storage device such as external hard disk or thumbdrive
More information on staying safe can be found on Go Safe Online website: https://www.gosafeonline.sg/
[ References ]
http://www.dcwg.org/index.html
http://www.fbi.gov/news/stories/2011/november/malware_110911/malware_110911
https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS
| < Prev | Next > |
|---|