Microsoft settles with No-IP after disrupting its business in botnet action

Microsoft has settled a claim against No-IP, the dynamic domain name service which suffered a major disruption in late June when it was caught in Microsoft’s tenth malware takedown effort.

Late last week Microsoft handed back all 23 primary domains that it had seized from No-IP on June 30 after gaining a US court’s approval to tackle the Bladabindi (NJrat) and Jenxcus (NJw0rm)  malware families.

Microsoft claimed the malware had infected around seven million machines over the past year and that No-IP’s dynamic DNS service was the malware’s primary source of malware control infrastructure.

On Wednesday, Microsoft and No-IP’s owner, Vitalwerks, announced they had reached a settlement, which includes permanently disabling the subdomains used as botnet control infrastructure.

“Microsoft has reviewed the evidence provided by Vitalwerks and enters into the settlement confident that Vitalwerks was not knowingly involved with the subdomains used to support malware. Those spreading the malware abused Vitalwerks’ services,” Microsoft said.

“Microsoft identified malware that had escaped Vitalwerks’ detection. Upon notification and review of the evidence, Vitalwerks took immediate corrective action allowing Microsoft to identify victims of this malware. The parties have agreed to permanently disable Vitalwerks subdomains used to control the malware.”

No-IP released an identical statement on its blog.

Microsoft was gunning for No-IP under the argument that it didn’t take sufficient steps to prevent criminals from abusing its services and cited several publicly available reports from security vendors that pointed to No-IP has a haven for criminal activity.

Microsoft’s domain seizure aimed at capturing and sinkholing over 18,000 malicious sub domains being used by the criminals. It said it would allow normal access to domains for good traffic, however No-IP claimed its “heavy-handed action” ended up blocking services used by millions of people.

Microsoft later admitted it had made a technical error and today reiterated its apology to No-IP customers affected by its action.

“In the process of redirecting traffic to its servers for malware detection, Microsoft acknowledges that a number of Vitalwerks customers were impacted by service outages as a result of a technical error. Microsoft regrets any inconvenience these customers may have experienced,” it said. 

 

Follow Liam Tung on Twitter 

This article is brought to you by Enex TestLab, content directors for CSO Australia.

Tags No-IPMicrosoftDNS serviceidentificationVitalwerksmalware

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Security Risk Management Solutions

Protect resources and ensure security compliance through incident detection, response, and remediation.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.