Samker's Computer Forum - SCforum.info

World TOP Headlines: => Latest Security News & Alerts => Topic started by: Pez on 08. March 2012., 13:16:34

Title: An Update on DNSChanger and Rogue DNS Servers
Post by: Pez on 08. March 2012., 13:16:34
In late 2011, the FBI released documents and data focusing on “Operation Ghost Click.” This malicious operation, leveraging a variety of DNSChanger-type malware, was defined by the FBI as an “international cyber ring that infected millions of computers.”

Associated malware samples and events can be traced back several years, and multiple platforms were targeted. To this day many remain affected or infected and are still open to compromise.

The amount of helpful data around this issue is plentiful. Even the FBI has provided a tool to check whether your host/IP is affected.

https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS (https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS)

So, fast-forward to the present: Within McAfee Labs we have been flooded with queries (forgive the DNS pun) on what will happen on March 8, and what other impacts might ripple through our environments as the FBI takes the next steps toward concluding Operation Ghost Click.

The Good News!

On March 5, a U.S. District Court in New York signed an order to extend the March 8 deadline to July 9.

This extension will allow all affected entities to continue to track down and remediate against hosts that are still compromised. Current data indicates that there are still several million infected or affected hosts worldwide.

Also, as a handy reminder, the offensive Netblocks are well documented:

•67.210.0.0 through 67.210.15.255
•93.188.160.0 through 93.188.167.255
•77.67.83.0 through 77.67.83.255
•213.109.64.0 through 213.109.79.255
•64.28.176.0 through 64.28.191.255
To learn more about how to maintain your online connection and to protect against this malware family, read our new Threat Advisory:

https://kc.mcafee.com/corporate/index?page=content&id=PD23652 (https://kc.mcafee.com/corporate/index?page=content&id=PD23652)

For McAfee Customers: Detection for associated malware is provided under the DNSChanger Trojan family.

For example: http://www.mcafee.com/threat-intelligence/malware/default.aspx?id=141841 (http://www.mcafee.com/threat-intelligence/malware/default.aspx?id=141841)

Other Resources:

•McAfee Labs Security Advisory MTIS11-219 (https://community.mcafee.com/docs/DOC-3270)
•McAfee Labs Threat Advisory on DNSChanger  (https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23652/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20DNSChanger.pdf)
•McAfee Labs DNSChanger Description Search (http://www.mcafee.com/apps/search/threat.aspx?q=DNSChanger&v=malware)
•The FBI’s DNSChanger Malware (http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf)
 •United States District Court Southern District of New York Post-Indictment Protective Order extending the March 8 date. (http://blogs.mcafee.com/enterprise/an-update-on-dnschanger-and-rogue-dns-servers/attachment/post-indictment-protective-order)

Orginal article: Tuesday, March 6, 2012 at 10:48am by Jim Walter  (http://blogs.mcafee.com/enterprise/an-update-on-dnschanger-and-rogue-dns-servers)
Title: Re: An Update on DNSChanger and Rogue DNS Servers
Post by: Samker on 08. March 2012., 15:41:11

Related topics:

- "FBI's "Operation Ghost Click" takedown biggest ever cyber-scam botnet": http://scforum.info/index.php/topic,7195.0.html (http://scforum.info/index.php/topic,7195.0.html)

- "Remove "DNSChanger" Trojan, Check is your PC infected ?!": http://scforum.info/index.php/topic,7472.0.html (http://scforum.info/index.php/topic,7472.0.html)