Half of Fortune 500s, US Agencies Still Infected With DNSChanger Trojan 112
tsu doh nimh writes "Two months after authorities shut down a massive Internet traffic hijacking scheme, the malicious software that powered the criminal network is still running on computers at half of the Fortune 500 companies, and on PCs at nearly 50 percent of all federal government agencies. Internet Identity, a Tacoma, Wash. company that sells security services, found evidence of at least one DNSChanger infection in computers at half of all Fortune 500 firms, and 27 out of 55 major government entities. Computers still infected with DNSChanger are up against a countdown clock. As part of the DNSChanger botnet takedown, the feds secured a court order to replace the Trojan's DNS infrastructure with surrogate, legitimate DNS servers. But those servers are only allowed to operate until March 8, 2012. Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web. The FBI is currently debating whether to extend the deadline or let it expire."
Just goes to show you (Score:4, Insightful)
The only people in IT that know what they are doing are the "hackers".
Re:Just goes to show you (Score:5, Insightful)
Re: (Score:1)
Wow how wrong you are, you simply say to the corporation "I'm a security consultant want to watch me get through your security?" they say "yes", you say "pay me" and then show then how insecure their network truly is.
It's not as though there are any shortages of hacking stories out there, take the STARTFOR hack recently, 200 gigs of data moved off the network and no one noticed? Unencrypted credit card data? Those seem like newb mistakes to me so they obviously could have benefited from a security audit by
Re: (Score:1)
Wow. it's that easy to get into a corporate network? After all, you might be employed by the competition to steal your corporate secrets.
Re:Just goes to show you (Score:4, Insightful)
That's sort of the point. If they had any brains we wouldn't need to be telling the CEO not to have his password on a post it note on his monitor.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Also, I believe best practices for penetration testing involves negotiating the parameters for the testing and documenting them in a contract. Otherwise it's risky for both sides of the transaction.
Re:Just goes to show you (Score:5, Insightful)
Wow how wrong you are, you simply say to the corporation "I'm a security consultant want to watch me get through your security?" they say "yes", you say "pay me" and then show then how insecure their network truly is.
Right, because the company is not going to ask to see your credentials before they pay you to attack their system. How do you get your credentials as a security consultant in the first place? How does anyone know that your time is worth paying for?
Re: (Score:1)
All you need are fancy laminated business cards. It's proof you are a professional.
Re: (Score:3)
Uhhhhh - no. Laminated business cards? That's geek, not professional. Pros get those cool embossed stiff paper business cards. Laminated is just to protect a geek's card from Cheeto dust.
Re: (Score:2)
Wow how wrong you are, you simply say to the corporation "I'm a security consultant want to watch me get through your security?" they say "yes", you say "pay me" and then show then how insecure their network truly is.
Right, because the company is not going to ask to see your credentials before they pay you to attack their system. How do you get your credentials as a security consultant in the first place? How does anyone know that your time is worth paying for?
Your first few jobs are payment after proving what you can do. They put a special file on the server. They pay you if you can produce the file for them. After they pay you, you tell them what you did and how to fix it.
It's not hard to build a relationship of trust, work your way up with respectable clients, and having a degree in cyber crime doesn't hurt either.
Re: (Score:3)
Wow, you have no conception of how corporation politics work, do you? You simply say to the corporation "I'm a security consultant want to watch me get through your security?" and they say, "If you attempt to hack our systems we will prosecute you to the fullest extent of the law."
Re: (Score:2)
Which is why I'd never do that. Fuck 'em. No one who may be hostile to me gets my help. I laugh at their misfortune and wish them more of same.
Shoot all the messengers ya want, I won't be among them.
Re: (Score:1)
Precisely reflected by "Wheel of Fortune"... Those people have more money, we are more intelligent and solve the puzzle.
Re: (Score:1)
What coincidence:
http://news.slashdot.org/story/12/02/05/1635243/job-seeking-hacker-gets-30-months-in-prison [slashdot.org]
Re: (Score:3)
Actually, if you think about it, the crackers have a much much easier time of it. They only have to find one security issue. The people in IT have to try and cover ALL security issues. Never mind the fact that it's impossible to cover all security issues, because IT staff don't always have access to source code, are not always expert programmers, and don't necessarily know the best security practices for all programming languages.
Re: (Score:1)
no, you've still got it simplified, you need to grab all the security problems on the network, in the order of most politically feasible to fix to least. One does not simply walk in to mordor. You pick on the little guys first, then the bigs get you axed for not "noticing" the stuff they knew was a problem.
Re: (Score:2)
The only people in IT that know what they are doing are the "hackers".
Yes and no. Hackers hack each other rather often, making the other hacker look "dumb".
But then the other hack hacks the first one back.
Then which one is better than the other uhm?
Well none. This stuff is just too darn complex to figure out all the variables at any point in time. You can just focus on some thing and make them better, or break them.
Or focus on the general issues and try to manage/detect/solve issues on a larger scale.
Or, of course, be a true genius (true being the keyword here), or redesign y
Re: (Score:2)
Oh boo hoo (Score:2, Insightful)
Maybe loss of service will finally motivate owners/managers to clean up the problem.
Re:Oh boo hoo (Score:5, Insightful)
As part of the DNSChanger botnet takedown, the feds secured a court order to replace the Trojan's DNS infrastructure with surrogate, legitimate DNS servers. But those servers are only allowed to operate until March 8, 2012. Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web.
Maybe loss of service will finally motivate owners/managers to clean up the problem.
You're right. The only way that most of these companies or government agencies will even realize that they are infected/affected will be when some of their PC's stop working properly.
Maybe not even then. (Score:2)
In my experience, they'll just poke at the non-functioning systems until they do something that makes them work again. Or until they run out of ideas and blame the "network card" or something and replace the hardware.
If they don't know that they're infected by now, they don't have the expertise (basic knowledge) to monitor their own systems.
They will just say "yep, that happens to computers sometimes" and move on. Never understanding that there is a huge hole in their security practices.
Re: (Score:2)
I'd recommend installing a different Trojan that points to another set of DNS-servers :) If you install an advanced trojan it should be able to keep out the competition as well, likely improving user experience on the computer.
Of course, the trade off may not be to their liking :)
Re: (Score:3)
Exactly. Just modify the DNS on the servers so that every entry goes to a server in fbi.gov that says "Your computer is infected and here's how to get rid of that."
Fuck'em (Score:5, Insightful)
Why, when you can shame 'em too? (Score:5, Insightful)
Re: (Score:1)
I don't think the FBI would have any interest in DDoSing their own server ...
Re: (Score:2)
Re: (Score:2)
using their dns server without being infected intrigues me for some strange reason. possibly it wouldn't have blocked domains..
Re: (Score:3)
The FBI is partnered up with GoDaddy, who historically they let handle these types of things.
They can let GoDaddy host the page, and their network wouldn't even notice it next to the other billion and a half parked and expired domain auction pages.
I'd be a little surprised of GoDaddy isn't who is currently providing the DNS infrastructure for what they are already doing anyway.
A tiny text web page with no graphics could easily come in at under 2kb.
Their servers support Z compression, so at least for all non
Re:Fuck'em (Score:5, Insightful)
They should have shut it down in the first place. It's wildly irresponsible and stupid for the FBI to have set up a replacement infrastructure.
Presumably the hosts that are compromised had a vulnerability. Leaving a working infrastructure in place has masked the signal not only that DNSChanger was installed, but that there might be an unpatched vulnerability. If they'd shut it down, staff would have looked at the boxes and identified that there was malware installed, then cleaned up the boxes in the process and fixed their patching process. Who knows what additional malware may have been installed in the interim using the same or other unpatched vulnerabilities, because the FBI meddled?
In addition, by taking the responsibility for maintaining a DNS infrastructure, they run the risk of contributing to another mass compromise if the replacement infrastructure is itself compromised or becomes the victim of a cache poisoning attack.
Stupid, stupid, stupid.
Cause is obvious (Score:5, Funny)
Re: (Score:1, Flamebait)
and all of them run Windows thinking it's an actual "operating system".
Re: (Score:1)
You mean the only operting system that can be remotely managed, has the business apps, supports Office (with outlook), has support from every IT professional in existence, can run on every PC ever made, wont break with an apt-get, ... not so real OS?
Sorry the age of green screen CRT terminals died over 2 decades ago. Not one is going to switch to the IBM mainframe or a big unix box.
The Wintel PC is here to stay in the Office.
Re: (Score:2)
Par
Re: (Score:2)
Redirection? (Score:5, Interesting)
Or for some time before the deadline,randomly redirect some requests to a page explaining that the computer is infected and internet will not be usable from the deadline onwards.
Re: (Score:2, Troll)
After the deadline, for a few weeks, redirect all traffic from these machines to a page explaining the issue
Or for some time before the deadline,randomly redirect some requests to a page explaining that the computer is infected and internet will not be usable from the deadline onwards.
Nah, Goatse and Rickroll'em
pathetic (Score:3, Insightful)
You just know there are tons of unemployed admins who could easily sort this shit out but instead these companies hired some douchebag fratboy who flunked out of law school to run their networks...
Re:pathetic (Score:5, Funny)
The guy in charge of hiring is the bosses son and he "knows the internet".
Re: (Score:2)
Probably not really. The smalled fortune 500 companies, D.R. Horton and Seaboard both have over 3000 employees (and seaboard is up around 9k), with even that many computers it would be fairly hard to be 100% sure all of them are clean all the time, especially across multiple sites and all that.
"27 out of 55 major government entities" (Score:1)
Re: (Score:2)
Can you imagine the swift response to correct the problem when the government workers find out they can't surf pr0n all day!
Hey, don't exaggerate. They aren't surfing pr0n all day; just for eight hours (maybe less if they're in late or leave early).
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You do realize that the penalty for surfing porn on government equipment is loss of government job? But thanks for helping spread the myth that government workers do nothing all day. In most cases, they have the worst jobs available, they have to put up with you, the unthinking public. You are the people who believe in JFK conspiracies, UFOs, that the Jews control everything, the Twin Towers was a CIA/FBI plot, etc.
Why are government employees... (Score:1)
IT Knows. (Score:1)
I came to post the same thing that everyone else already posted: Let them expire!
These people obviously need better protection and the only way they're going to know they're infected is if you let their computers just stop working.
It amazes me that everyone here gets it instinctively, but whatever 'experts' work for the government can't think their way through it.
Seriously? (Score:5, Insightful)
any computers still infected with DNSChanger may no longer be able to browse the Web
There are over 250 IT departments that not only allow infected machines to remain on the network but allow users to continue to use them?!? The IT world has officially gone to shit. I'm going back to bed.
Re: (Score:2)
Is it the fault of IT, management or the users?
Yes. Dig a hole...
Re: (Score:1)
IT doesn't have time to check every PC for malware. They are just trying not to get fired as the CEO and bean counters look at them as wasteful cost centers that bring down the share price and offer no business value.
Unless something breaks they wont ever know.
Re: (Score:2)
http://alienvault.com/community [alienvault.com]
Re: (Score:2)
Most of the places I've worked have suffered from at least one serious security hole that has gone unaddressed due to either lack of comprehension, lack of skill or lack of funding; be it as obvious as everyone running as root/local admin or more "policy based" problems such as applying crippling restrictions on web browsing but having ways around the filters for "important" people (read: management) that inevitably find their way into the hands of the rest of the staff so that you might as well just turn o
Re: (Score:2)
due to either lack of comprehension, lack of skill or lack of funding
You could have just written, "Bought managers penis enlarging iDevice instead of funding IT". Everyone would have understood.
Which can be translated to... (Score:1)
MSE? (Score:2)
I'm guessing govt. departments dont use pirated windows, so why not just update MSE definitions to detect this trojan?
Re: (Score:1)
Unless the trojan just prevents the signatures for it to be downloaded.
Re: (Score:3)
That's about 3 steps too many. That's why it doesn't happen.
Re: (Score:1)
Not that simple. Most use symantic endpoint which will conflict with mse. Users dont have admin rights and there is nothing they can do. Mse is forbidden with more than 10 users.
Besides the policy from the cio is to use only approved software he bought from his games of golf with slick salesmen. It costs money to hire compentent IT professionals and the bean counters hate this as the goal of the company is to raise its stock price and not keep computers clean.
Re: (Score:2)
Even if MSE isn't an option, the standard "Windows Malicious Software Removal Tool" that Microsoft makes available as part of every "Patch Tuesday" should be something IT departments are running on their systems.
Window only? (Score:2)
Do I have to worry about my Linux and Mac computers?
The article isn't clear (as usual) .
Re: (Score:3)
I was poking around and found some tips for removing it from OS X machines, so I'm guessing it can affect those.
IPv5 (Score:3, Funny)
According to the explanation picture in TFA, the address for the contact page of fbi.gov is 987.654.321. Is that IPv5?
Re:IPv5 (Score:5, Funny)
According to the explanation picture in TFA, the address for the contact page of fbi.gov is 987.654.321. Is that IPv5?
That's their phone number, you idiot. The FBI doesn't use computers yet.
Screw em if they are to lazy to do their job (Score:1)
Oh Noes! (Score:2)
Unless the court extends that order, any computers still infected with DNSChanger may no longer be able to browse the Web.
Stupid people kicked off the 'Net? What will become of us?
Sadly, since many of these systems are corporate machines, it means that their users are probably prohibited from patching them themselves. So if some PHB has failed to authorize IT to perform the fix, everyone else will suffer.
In other news (Score:2)
Users with the system Linux, like Ubuntu, Fedora, Redhat, etc. are still save and still waiting for a virus to target them in the wild.
In other news, Pwn2Own will no more have any Linux systems in the competition, because it would be futile attempt anyway and the proprietary system companies looking bad in comparison.
Re: (Score:2)
You poor simple douche. You did get part of your idiocy right - red heads aren't cool, they are HOT! The rest? I hear you whining, "I haven't managed to code any malware that will run reliably on Linux - aww, fuck it, there aren't enough Linux computers to infect anyway!"
Just run along and play with your self, you douche. Here's a magnifying glass and a pair of tweezers. And, don't be messing with that redhead down the street. She'll tear your fucking head off, and shit down your windpipe, 'cause she
Re: (Score:2)
There, there, suffering from low male testosterone again, are we? There are pills you can get, just watch the TV like a good little social misfit.
Like playing Whack A Mole (Score:5, Interesting)
Re: (Score:2)
Once someone who's trying to do actual work gets their manager involved, then IT shoots back with "well, we have to certify that it's secure and that will take X months". Management gets sick of IT constantly getting in the way and tells them to bugger off.
IT thinks they can come up with a whitelist o
Re: (Score:2)
Most of those issues are caused by one of two things: 1) Policies created by some moron who doesn't know anything about IT but read a white paper once so thinks they're God's Gift to compliance (my current employer blocks any website that uses a META Refesh because of some reason...security...compliance) or 2) IT staff with a God Complex. Neither are that hard to fix, but both seem endemic across the corporate and government world.
Smart IT departments deal with this with: "Show me that you need this program
Re: (Score:2)
half is both an exagerrated and self-serving number.
The way they stated it is exaggerating, but the numbers are plausible. They said they found at least 1 infected computer in half of the Fortune 500 companies, plus one in 27 out of 55 govt agencies. That's a whole whopping 277 computers. Entirely possible. They probably just looked at the logs from the DNS servers.
Re: (Score:2)
... I'd rather have someone who won't cause problems than someone who will find solutions.
That sounds just like the douche bag admins who're so powerless/ineffectual/ignorant that they let half of Fortune 500 companies and gov't agencies continue to run malware long after they'd been warned about it.
Now I understand. The Ostrich defense.
Transparent proxy (Score:2)
Couldn't this be mitigated by redirecting all DNS packets to corporate DNS servers and logging all requests for something else?
Let it expire (Score:2)
These companies and agencies need a solid smack to their face. "NO! NO INTERNET FOR YOU! FIX YOUR SHIT!"
If the just turn them off... (Score:3)
If the just turn them off then the systems wit the problems will HAVE to be fixed, isn't that the idea?
Perhaps instead of just turning them off when the time is up, start now by redirecting every request to a webpage explaining what is wrong and
a link to a removal tool.
Re: (Score:2)
Mod paret up +1 Insightful
Why? (Score:1)
Why are we letting the government give a pass to big businesses that simply can't secure their computers. We should be fining them for letting the malware infect their computers in the first place, rather then allowing all the malware to stay on the computers in the first place.
We are just perpetuating the malware/virus problem by giving companies a pass. They won't learn anything, they won't be more money in security since they will think: "Oh we just have to wait for the government to step in, then we