DNSChanger may take 300,000 offline

DNSChanger malware, which began spreading in 2007, could prevent up to 300,000 computers worldwide from connecting to the internet

• Share
• Tweet this
• Email

As many as 300,000 people could see their computers go offline on Monday, as the effects of an FBI battle with a gang of Estonian cyberthieves over a piece of malware called "DNSChanger" reaches its climax.

People whose PCs won't connect to the net from Monday may have to call ISPs to figure out a fix, which will involve changing settings in their computer used to look up websites.

Those affected, who will already have ignored multiple warnings from services such as Google, may find that task challenging; more skilledinternet users will already have heard about the problem.

The affected computers, whose numbers have fallen dramatically from around 4m among 100 countries during the malware's peak activity between 2007 and 2011, will be cut off because the lookup system they use to find sites online, called the DNS servers, will try to connect to computers formerly owned by the gang which are being shut down. That means that attempts to connect to any site will fail.

DNS (domain name system) servers provide a core function of the internet. They translates an address such as "guardian.co.uk" to a numerical one such as "77.91.248.30" – so that typinghttp://guardian.co.uk into a web browser has the same effect as typinghttp://77.91.248.30.

The "DNSChanger" malware began spreading in 2007 and affected computers by changing the settings on PCs so that they would use the Estonian hacker ring's DNS servers to look up addresses, rather than those of the user's ISP or other services.

Affected computers would be pointed to advertising sites rather than the ones requested, earning the hackers an estimated $14m (£8.7m).

But the FBI cracked down on the scam, finally getting control of the hackers' DNS servers in November 2011. Six people were charged in November 2011 after being arrested in Estonia, and a seventh was sought in connection with the crimes.

The agency set up "Operation Ghost Click" and spent two years tracking the gang using the DNSChanger malware, eventually seizing 100 servers in New York and Chicago that they reckoned were part of the command and control infrastructure used to control the "clickjacking" business.

"They victimised legitimate website operators and advertisers who missed out on income through click hijacking and ad replacement fraud," the FBI's Janice Fedarcyk, assistant director at its New York office, said at the time.

However, rather than taking them offline at once, which would have left huge numbers of people in the lurch, the FBI took the unusual step of bringing in a private company to keep the servers running, and offered diversion schemes to warn people their computers were affected.

The number of affected users has been falling steadliy, but the FBI reckons that there are still around 45,600 in the US, and between 250,000 and 350,000 worldwide.

The original plan had been to shut down the DNS servers in March, but the FBI delayed that to allow more time for security companies and ISPs to warn customers.

How to check

If a computer fails to connect to websites, the FBI and other companies are offering a testing service at http://www.dcwg.org/detect – but affected machines probably won't be able to connect to that from Monday because it requires a DNS lookup.