Internet will vanish Monday for 300,000 infected computers

Users must wipe DNSChanger malware from PCs and Macs before 12:01 a.m. ET July 9

As many as 300,000 PCs and Macs will drop off the Internet in about 65 hours unless their owners heed last-minute calls to scrub their machines of malware.

According to a group of security experts formed to combat DNSChanger, between a quarter-million and 300,000 computers, perhaps many more, were still infected as of July 2.

DNSChanger hijacked users' clicks by modifying their computers' domain name system (DNS) settings to send URL requests to the criminals' own servers, a tactic that shunted victims to hacker-created sites that resembled real domains.

At one point, as many as 4 million PCs and Macs were infected with the malware, which earned its makers $14 million, U.S. federal authorities have said.

Infected machines will lose their link to the Internet at 12:01 a.m. ET Monday, July 9, when replacement DNS servers go dark.

The servers, which have been maintained under a federal court order by Internet Systems Consortium (ISC), the non-profit group that maintains the popular BIND DNS open-source software, were deployed last year after the Federal Bureau of Investigation (FBI) seized more than 100 command-and-control (C&C) systems during the take-down of the hacker gang responsible for DNSChanger.

The FBI's "Operation Ghost Click" ended with arrests of six Estonian men -- a seventh, a Russian, remains at large -- the C&C seizures, and the substitution of the replacement servers. Without the substitutes, DNSChanger-infected systems would have been immediately knocked off the Internet.

Originally, the stand-in servers were to be turned off March 8, but a federal judge extended the deadline to July 9.

It's not just consumer PCs and Macs -- DNSChanger was equal-opportunity malware -- that remain infected, but also corporate computers and systems at government agencies, said Tacoma, Wash.-based Internet Identity (IID), which has been monitoring cleanup efforts.

Last week, IID said that its scans showed 12% of Fortune 500 firms, or about one out of every eight, harbored DNSChanger-compromised computers or routers. And two out of 55 scanned U.S. government departments or agencies -- or 3.6% -- also had failed to scrub all their PCs and Macs.

The newest numbers were down from earlier scans by IID. In March, for example, the company pegged the Fortune 500 DNSChanger infection rate at 19% and the government agency rate at 9%.

In January, both groups' rate was an amazing 50%.

But there are still tens of thousands of laggards who have not cleaned their computers, even after a months-long effort by the DNSChanger Working Group (DCWG), a volunteer organization of security professionals and companies.

"We're all struggling with this," said Rod Rasmussen, chief technology officer of IID and a member of the DCWG. "There are a lot of people who just haven't gotten the word."

The cleanup, Rasmussen said, has been the tough part of the DNSChanger takedown.

"There was a lot of planning done for the initial takedown, the arrests, the swapping of servers, but there wasn't as much for after the take-down," said Rasmussen. "How do we clean things up? Victim remediation is a challenge for our industry. Everyone wants to do it, but how do you pay for it?"

The DCWG worked extensively with ISPs (Internet service providers) to help them alert customers with infected computers -- identified by their being shuttled through the replacement servers -- and advise them on removing the malware. The group also reached out to enterprises, government agencies and other organizations to offer the same assistance.

At times, that worked.

"Some ISPs have been very draconian," said Rasmussen, citing providers that repeatedly called, emailed or phoned members with infected computers. "Some worked hard at a fair amount of expense."

Others instead prepared for the support calls they expect to field starting Monday when startled customers realize they can't get online. "They're staffing up for [Monday], they know that they're going to get [a large number of calls]."

For those that have done nothing, Monday will be rough, Rasmussen predicted. "For some ISPs, this may be a real flap," he said.

But the project was sometimes frustrating.

One company, which Rasmussen would not name, had cleaned all its machines of DNSChanger, but was repeatedly re-infected. Finally, the firm discovered that laptops connecting to its public Wi-Fi network were spreading the malware, and even narrowed the list of suspects to the media because the timing of the re-infections coincided with press events the corporation held on its campus.

Even so, the effort has been worthwhile, not simply to ameliorate the impact, but as a learning experience for future such takedowns, or of "sinkholing" botnets in general.

"What we need in the future is a real-time alerting capability," said Rasmussen, and described a system that would immediately notify a user if his or her computer had been shunted to a substitute server. The idea was discussed by the DCWG, but never implemented because it would have required much more hardware and support than was available.

"Someone has to support this volunteer effort," said Rasmussen, who didn't have an answer for where that support, whether financial or other resources, would come from.

Two of the Internet biggest companies have also pitched with their own anti-DNSChanger campaigns.

In late May, Google began warning infected users with a bannered message at the top of the company's search results page. Several days later, Facebook kicked off a similar alert for its members.

Users have access to several free tools that identify infected computers, including several that just debuted under the DCWG's auspices. In the U.S., for example, users can steer to the website. Other detection sites are listed on the DCWG's domain.

The DCWG's website also has links to free tools that remove the malware.

But perhaps the loss of the Web is the only wake-up call some users will hear, Rasmussen said.

A few in the DCWG lobbied to stick to the original March 8 deadline and against an extension, believing that only a "tough love" approach would work, said Rasmussen.

"Some people haven't been paying attention to the messages," he said. "It's not a lot, but they're very reticent to do anything."

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, send e-mail to or subscribe to Gregg's RSS feed .

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts