17 ms·

Microsoft takes down No-IP.com domains

315 points by anExcitedBeast 12y ago

runarb 12y ago
Has I understood this correctly? Microsoft, a private company, has been granted the right to filter all dns traffic, and choose what will bee forward to this other company, No-IP. No-IP will so bee allowed to run there service for the remaining customers Microsoft approves? Is this common practices in the us legal system? Would it work like this in the offline world also? If my neighbor sometimes had loud parties that bothered me, could I be granted the right to stand in front of his door and turn any potential troublemakers away.
- lstamour 12y ago
  It's a temporary restraining order. It obviously affects Microsoft's products and its customers. It would be equivalent to say, blocking a phone switch that was misbehaving and calling you continuously causing a denial of service attack. That Microsoft customers are suffering more than Microsoft itself and that No-IP appeared to be in denial seems to support the temporary restraining order -- No-IP, aware of such reports via blog posts, chooses to do nothing by asking for reports rather than investigating and stopping the behaviour themselves.
- ntakasaki 12y ago
  >If my neighbor sometimes had loud parties that bothered me, could I be granted the right to stand in front of his door What if they were bothering 7.4 million people and inconveniencing many more? And then didn't show up in court in spite of summons? The police or courts will take that far more seriously.
  - deleted 12y ago
    [deleted]
  - nitrogen 12y ago
    Microsoft is not the police or courts.
    - cpncrunch 12y ago
      It was the court that allowed Microsoft to do this.
      - serf 12y ago
        the court deciding that a company (Microsoft) should act as the police (or in this analogy, a bouncer) is still terribly short-sighted, especially when that company has been historically accused by the DOJ of attempting to form varying monopolies. a capable government should not be in the habit of contracting valuable state-needed cyber-defense to private companys, as the 'keys to the kingdom', in this case domain records, should not be in the hands of a company that can benefit privately but rather a state-ran agency which employs proper check and balances.
      - plaguuuuuu 12y ago
        A court appointed a private corporation to act as a police agency.
  - alasdair_ 12y ago
    Hotmail.com and outlook.com are regularly used to send out malware. I know this because I have received some personally every couple of months for the last 4-5 years. It's highly likely that over the years, more that 7.4 million spam emails have been sent through Microsoft's systems. Under the bar set by this judge, I should be able to apply for, and receive, ownership of outlook.com based on the fact that Microsoft doesn't always rush to comply with emails that I send them. It won't happen, of course, because Microsoft has more money than I do (and because it's a fucking stupid idea). This is an appalling remedy and I hope Microsoft and the Judge in question face serious repercussions for it.
- pjc50 12y ago
  Is this common practices in the us legal system? Courts not understanding the social effects of technological law and making an order in favour of the more "respectable" looking party? Happens all the time.
nathanb 12y ago
So let me get this straight...Microsoft took down a free provider of dynamic DNS services because people have used those services to distribute and control malware? Where is the due process? Where is the oversight in this? All I'm seeing is vigilanteism.
- andrewstuart2 12y ago
  Court-authorized vigilantism.
  - cwyers 12y ago
    By definition, if it's court-authorized, it's not vigilantism.
    - JacobEdelman 12y ago
      If a court legalizes Batman then its court authorized, but he's still not a publicly controlled entity and those still a vigilante.
      - MBCook 12y ago
        Vigilante. N. A member of a self-appointed group of citizens who undertake law enforcement in their community WITHOUT LEGAL AUTHROITY, typically because the legal agencies are thought to be inadequate.
      - wtracy 12y ago
        It's called "deputizing", and a deputy is not a vigilante pretty much by definition.
        Dylan16807 12y ago
        The judiciary has the ability to deputize law enforcement? I thought those were supposed to have independent structure.
- 12y ago
deleted 12y ago
[deleted]
pktgen 12y ago
FWIW, in my experience, No-IP is very, very responsive and helpful to abuse complaints. Though that is the extent of my experience with them, I've never thought them to be actively harboring malicious activity (unlike, say, CloudFlare).
- duskwuff 12y ago
  While I'm not familiar with the exact situation here, I suspect the real problem is that the malware domains are being automatically created en masse, and No-IP have been slow or reluctant to do anything to slow that down. Being responsive to complaints is good for small-scale problems involving individual domains, but basically useless for large-scale abuse.
  - gcb0 12y ago
    what if a company like microsoft approach you and say "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" granted, i'm not familiar with the matter. but I know what I would answer. also, removing noip or noip enabling whatever microsoft was bullying them to implement, would just delay it a few days until the worm creators rolled out their own service. heck that can even motivate them to get creative and encode IPs in a obfuscated pastebin, or stenographed in cat pictures in reddit, or noise mp3 in soundcloud... maybe having them rely on noip was good.... but again, i have no knowledge of the matter. maybe noip was being paid even after knowing it was for worms. who knows?
    - wfjackson 12y ago
      > "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" How can they patch it in their product without turning desktop Windows into something like iOS or Windows Phone/RT? Even Android has a ton of malware so the notion that Windows is somehow more hole ridden than other platforms stopped being true starting about 10 years ago with their Secure computing initiative. If the user can install Firefox, they can install malware. If Firefox doesn't need to get permission from MS for their next version, Windows cannot distinguish between Firefox.exe and Codec_Flash_Shady.exe. Sandboxing will disable system level utilities. MS is capable of making secure OSes. How many viruses and trojans do the 3 Xboxes, Windows Phone and RT have? Even Windows Server is pretty secure(atleast as secure as Linux) unless the admins start browsing on it. Malware is a real threat to any popular OS unless third party apps are entirely blocked or restricted by the use of a approval based App Store. Windows gives much more control to the user, which is why many users are able to stay away from infections. And it's ironic that you're blaming MS here instead of the folks that propagate it(including a YC company https://www.techdirt.com/articles/20130115/17343321692/why-are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml https://www.techdirt.com/articles/20130115/17343321692/why-a...) and people who install it(users). Remember the shitstorm that was raised against MS on here and elsewhere when they tried to secure users by preventing undetectable rootkits by enabling Secure Boot?
kqr2 12y ago
Any alternatives for free dynamic DNS?
- pstatho 12y ago
  afraid.org is a good alternative.
- nvr219 12y ago
  Hurricane Electric: https://dns.he.net/ https://dns.he.net/
  - makmanalp 12y ago
    Whoa, he.net is alive and kicking. These guys used to run an efnet server back in the day.
    - lucb1e 12y ago
      And I heard they do free IPv6 tunnels. Pretty cool.
      - kordless 12y ago
        HE is awesome.
- timdorr 12y ago
  I've been using http://freedns.afraid.org/ http://freedns.afraid.org/ ever since DynDNS went paid only.
- andrewstuart2 12y ago
  If you own a domain name, a lot of registrars let you query some https endpoint to update DNS, which you can plug into firmware like DD-WRT. Namecheap, for one, does. I know this because I did it this morning after no-ip stopped working for me.
tokenizerrr 12y ago
So does this mean no-ip.com is no more, or only a subset of their domains?
- lstamour 12y ago
  It means, temporarily, a subset of traffic known to be from these viruses should be blocked, within part of the US, it seems.
  - tokenizerrr 12y ago
    Being in the Netherlands I can confirm that I got the same results as https://news.ycombinator.com/item?id=7967853 https://news.ycombinator.com/item?id=7967853, so not just the US.
  - andrewcooke 12y ago
    it's more than that. i cannot get to my (presumably clean, running linux, carefully maintained) home machine situated in chile, connecting from the uk.
- dougaa 12y ago
  No-ip is operational, but no longer handles the 22 domains Microsoft took over. I use no-ip's DNS for a domain name that's registered somewhere else, and it's unaffected. From what I read somewhere else, the reason legitimate domain names are being affected is because Microsoft's servers can't handle the load.
norswap 12y ago
Just when you thought it had been a long time since Microsoft was last evil.
- deleted 12y ago
  [deleted]
ars 12y ago
Wait what? If I have a domain with no-ip.com will it continue to work? Does Microsoft effectively own them now?
- blacksmith_tb 12y ago
  Mine is not working.
- davidu 12y ago
  They domain will work, subdomains on at least no-ip.biz and no-ip.org aren't going to work.
Zancarius 12y ago
> On June 26, the court granted our request and made Microsoft the DNS authority for the company’s 23 free No-IP domains, allowing us to identify and route all known bad traffic to the Microsoft sinkhole and classify the identified threats. Something about this bothers me. So the courts granted MS the rights to essentially take over No-IP's DNS in order to "identify" ... "bad traffic?" The implications of this are... chilling. As much as I want to reserve judgement, this makes me uneasy (malware aside).
- informatimago 12y ago
  Don't use .com, .net, .org, .edu; use domain names in your own sovereignty! Microsoft would have it much harder to get no-ip.ru or no-ip.zh (granted, a little easier grabbing no-ip.fr).
- DINKDINK 12y ago
  https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin Distributed DNS is the only solution
  - zanny 12y ago
    And meshnets. DNS is just a layer on top of an already vulnerable IP stack. IP can work between broad and anonymous mesh nets, but when an IP address can be resolved to a business or person it provides an exploit vector.
    - walden42 12y ago
      Like MaidSafe? Are there other alternatives?
  - dsl 12y ago
    So malware authors will be able to operate with impunity? As in all things, the solution is somewhere in the middle.
  - livingparadox 12y ago
    It doesn't serve No-IP's market, because No-IP is for frequently changing IP addresses. Namecoin charges for each record change, to my knowledge.
vfclists 12y ago
Loads of self-congratulating tripe. Microsoft why don't you simply provide free OS upgrades or fixes for the millions of XP computers out there? They are not going anywhere soon. Next thing we know your lawyers and lobbyists are going to come up with some legislative wheeze and you will be running the biggest botnet in the world. You created the problem so fix it yourself.
- vfclists 12y ago
  Wholly predictable downvoting by anonymously cowardly Microsoft brown-nosers.
  - TallGuyShort 12y ago
    Fine. I downvoted you, and it's no longer anonymous. I downvoted you because both of your comments were filled with passionate garbage rather than any well-reasoned thought. I'd be willing to bet other downvoters were not simply cowardly Microsoft brown-nosers.
    - spion 12y ago
      Its hard to stay calm if you were relying on no-ip's services for very legitimate purposes. Maybe the action coming from Microsoft is whats garbage - not the resulting emotional outbursts.
    - vfclists 12y ago
      Which ever way you cut it technically speaking Microsoft runs the biggest botnet because they have control all the computers running Windows upgrade, and if they can't shut them down, they might as well fix them. Whether you like it or not for better or worse a botnet is an economic resource whose value is not lost on Microsoft and sooner or later they are going to come up with a wheeze to exploit them.
      - kordless 12y ago
        You are missing the point. He said why he downvoted you and you replied with a general rationalization on why he should agree with you, when that's entirely NOT the point. You'll catch more flies with honey than you will with vinegar. We probably all agree with you in some fashion, just not the way you put it. And, just in case YOU can't figure it out, the blaming statements you are making are due to the use of 'you' in your comment.
alasdair_ 12y ago
"On June 19, Microsoft filed for an ex parte temporary restraining order (TRO) from the U.S. District Court for Nevada against No-IP. On June 26, the court granted our request and made Microsoft the DNS authority for the company’s 23 free No-IP domains, allowing us to identify and route all known bad traffic to the Microsoft sinkhole and classify the identified threats. " How can this be legal? Does this mean that if I get malware from a hotmail.com address, I can file for a TRO against Microsoft and control their domains? I honestly don't understand why Microsoft should be given this ability.
- tptacek 12y ago
  It's an ex parte order, so presumably Vitalwerks didn't show up in court despite the summons? If you filed for a TRO against Microsoft and their lawyers ignored it, something bad might happen to them too.
  - starik36 12y ago
    Ex parte order can be given even if Vitalwerks does show up (source: divorce court). Ex-parte simply means that it was an emergency and couldn't wait. However, it also means that a new full hearing has been setup (likely in 2 weeks or so) where both parties can argue their case. The full decision will be taken then.
  - bradleyjg 12y ago
    Ex parte means "from (by or for) one party", the judge acts upon the moving party's request without hearing from the other party. They are supposed to be rare and meet a high bar -- generally involving emergencies (and occasionally involving actions that need to remain secret). Given that the allegations span many months, it's hard to see how it was an appropriate form of action here. I'd be very interested to see if there was a written decision granting the TRO. Edit: This appears to be it http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order%20-%20flattened.pdf http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order...
    - giancarlostoro 12y ago
andrewstuart2 12y ago
So let me get this straight. Microsoft got a court order to route all of another entity's DNS traffic to their servers. Giving them the ability to route a metric crap-ton of private traffic through their data centers. For "security". I call shenanigans. I'm also assuming this is why my no-ip domain disappeared this morning, leaving me with no access to my home servers. Perhaps the linux on my servers is considered malware. It sure is malicious to Microsoft's bottom line. I kid, but only a little.
- robert_nsu 12y ago
  Not exactly. > allowing us to identify and route all known bad traffic to the Microsoft sinkhole and classify the identified threats. According to MSFT, they are only looking at known "bad" traffic. You can take their word for it... or not.
  - pbhjpbhj 12y ago
    If that last line were true then surely the GP's noip domain would still work and traffic would be routing without any interference. Ergo, they are telling lies as they are not simply routing "bad traffic" elsewhere but also "good traffic".
  - marcosdumay 12y ago
    How do they know that some data is "bad" before looking at it? And I'm asking only because I know the answer - that it's impossible, they are looking at the entire traffic and (officially) deciding if it's "bad" afterwards.
  - hendersoon 12y ago
    That's what they said, but that is not what happened. They couldn't handle the load and every noip hostname stopped working. Every one.
nostromo 12y ago
According to Reuters, Microsoft is only sending traffic from computers that are infected with malware to Microsoft instead of No-IP. http://uk.reuters.com/article/2014/06/30/us-cybercrime-microsoft-idUKKBN0F52A920140630 http://uk.reuters.com/article/2014/06/30/us-cybercrime-micro... That may still make people uncomfortable, but it seems much less egregious than Microsoft taking control of No-IP's domains, which is what this press release implies. Edit: the reuters article is in error here, not the Microsoft Blog. See below. Turns out this really is as egregious as it sounds.
- andrewstuart2 12y ago
  > Microsoft is only sending traffic from computers that are infected to Microsoft instead of No-IP. Unfortunately that's false. See below: dig -t ns no-ip.biz ; <<>> DiG 9.9.2-P2 <<>> -t ns no-ip.biz ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7020 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;no-ip.biz. IN NS ;; ANSWER SECTION: no-ip.biz. 7154 IN NS ns8.microsoftinternetsafety.net. no-ip.biz. 7154 IN NS ns7.microsoftinternetsafety.net. ;; ADDITIONAL SECTION: ns8.microsoftinternetsafety.net. 3560 IN A 157.56.78.93 ;; Query time: 3 msec ;; SERVER: 10.1.1.3#53(10.1.1.3) ;; WHEN: Mon Jun 30 14:14:47 2014 ;; MSG SIZE rcvd: 117
  - nostromo 12y ago
    What DNS are you using? On Google (8.8.8.8) or Comcast DNS I'm not seeing this for their top domains (no-ip.org, no-ip.biz, no-ip.info). I wonder if your ISP is working with Microsoft.
    - lstamour 12y ago
      It's strange, I've yet to see it too, in Canada. Must be within a limited area for the ISP, or thanks to the collaboration with A10 Networks. E.g. https://www.whatsmydns.net/#NS/no-ip.com https://www.whatsmydns.net/#NS/no-ip.com
    - 12y ago
sakawa 12y ago
I guess this is a shortcut to solve some problems. No-IP domains are used only by who hasn't a good infrastructure to support his infected network. And especially, why don't Microsoft take care of making his OS more secure?
davidu 12y ago
This is an incredible action by Microsoft, and the courts.
andmarios 12y ago
Which dynamic DNS service will be next? But I have a better idea. Windows are an easy target for cybercriminals; maybe someone should step up and take Microsoft down.
- diminoten 12y ago
  What kind of a thug do you have to be to think like this?
  - andmarios 12y ago
    A microsoft employee probably.
- andmarios 12y ago
  Funny how I got all this downvoting because I used the exact same phrase as Microsoft did in their blog post to justify why they took down noip domains. Microsoft wrote “Free Dynamic DNS is an easy target for cybercriminals”. Are my concerns that more free dynamic DNS services will follow unfounded?
mschuster91 12y ago
Just ran a dig +trace on no-ip.biz. Just... wtf. Who had acted upon that court order?! I thought that the days the US had full control over the internet were LONG past. ` biz. 172800 IN NS a.gtld.biz. biz. 172800 IN NS b.gtld.biz. biz. 172800 IN NS c.gtld.biz. biz. 172800 IN NS e.gtld.biz. biz. 172800 IN NS f.gtld.biz. biz. 172800 IN NS k.gtld.biz. ;; Received 308 bytes from 192.203.230.10#53(192.203.230.10) in 526 ms no-ip.biz. 7200 IN NS NS7.MICROSOFTINTERNETSAFETY.NET. no-ip.biz. 7200 IN NS NS8.MICROSOFTINTERNETSAFETY.NET. ;; Received 90 bytes from 209.173.58.66#53(209.173.58.66) in 150 ms no-ip.biz. 76834 IN NS nf5.no-ip.com. no-ip.biz. 76834 IN NS nf2.no-ip.com. no-ip.biz. 76834 IN NS nf4.no-ip.com. no-ip.biz. 76834 IN NS nf3.no-ip.com. no-ip.biz. 76834 IN NS nf1.no-ip.com. ;; Received 206 bytes from 157.56.78.73#53(157.56.78.73) in 344 ms
- jauer 12y ago
  "full control over the internet" is distinct from control over US corporations. Dot biz is operated by Neustar and they are based in Virginia and thus subject to US Courts. For example, they likely would have had less success enforcing a change on a .ir domain as the registry isn't located in US jurisdiction.
  - mschuster91 12y ago
    I bet that the US were not above to forcing the root DNS server providers to redirect the NS for .ir to some 3-letter-agency.
spion 12y ago
This is quite outrageous. I've been using no-ip.com for very legitimate purposes and this will surely result with a lot of breakage. Thanks Microsoft. Thanks a lot.
- Omniusaspirer 12y ago
  As another completely legitimate user what strikes me the most with this is how they did their best to basically pull off a sneak attack. I mean really? Microsoft just couldn't be bothered to give any forewarning to the millions of customers who's services they were directly interfering with? Tack on the dubious reasoning and the alleged failure to even contact NOIP at all before having this court order issued and this puts Microsoft in a really bad light. I'm not mad at NOIP about malware (frankly- I don't give a single shit), but I'm absolutely mad at Microsoft for pulling this bullshit and interfering with services I paid for completely out of nowhere.
  - spion 12y ago
    Indeed. Luckily I have a domain: now I'm going to fix this by setting up a CNAME and an account at another dyndns provider. Now if the other provider goes down, it should be possible to quickly make a switch without changing it in 1000 places* Should've thought of this earlier. Well, hindsight is 20/20 * includes git remote configuration, configuration files, scripts, bookmarked/saved links, and the worst: other people's links.
  - hendersoon 12y ago
    Well, for "bulletproof" hosters that really are complicit in their customers' activities, you need to pull a sneak attack, so the bad actors don't have the chance to switch hosts. So I'm fine with that part of it. I'm not fine with classifying noip as complicit. It's not.
deniska 12y ago
And I was wondering, why did my no-ip.biz subdomain stop working…
- tokenizerrr 12y ago
  So they are not even forwarding legitimate traffic? Did they just take the entire company down?
  - smellf 12y ago
    It looks like it to me - I have personal services running through them as well and my stuff stopped working last week. Of course, I also had multiple concurrent hardware failures, so I was assuming it was just that.
rblatz 12y ago
Their status twitter is interesting, they aren't going into any details as to why their service stopped working, and they haven't made any statements about the accusations against them. https://twitter.com/NoIPStatus https://twitter.com/NoIPStatus
- hendersoon 12y ago
  No-ip's official response is here: https://www.noip.com/blog/2014/06/30/ips-formal-statement-microsoft-takedown/ https://www.noip.com/blog/2014/06/30/ips-formal-statement-mi...
  - rblatz 12y ago
    Thanks, I checked their site and they had not posted a response when I commented.
hendersoon 12y ago
It's just plain outrageous that this court order was granted. It essentially puts no-ip out of business when they were not complicit in anything illegal. It took me 5 minutes to switch my completely legitimate hosts over to ddns.net. I'm sure the evil botnet owners have backup hostnames and will do the same, or more likely switch to another provider entirely. The end result will be a short-lived dip in criminal activity over the next 72 hours or so, inconveniencing many thousands of legit users, and putting a completely innocent company out of business. Nice move, MS.
- dsl 12y ago
  No-ip was complicit in the illegal activity. If you use a car wash that is also laundering money, your legitimate need for a clean car is not a defense against shutting the business down.
  - regd005 12y ago
    So if some number of people use cars for illegal activities should we shut down the gas stations that they use to fuel them?
  - Omniusaspirer 12y ago
    But that's an awful analogy and frankly you should be ashamed for even trying to paint it in that light. NOIP did nothing illegal whatsoever, their only "crime" was that they didn't do enough about malware distribution to keep Microsoft happy- which last I heard wasn't illegal. To use your car wash analogy, it's more like the car wash unknowingly washed the car of a drug trafficker and then was essentially put out of business the next day for being "complicit in the illegal activity".
    - lukeschlather 12y ago
      I am uneasy about this situation, but the car wash in question is more like the car painting shop in Grand Theft Auto. Even if painting cars is a legitimate activity, when 75% of your customers are trying to mask illegal activity you should be doing some due diligence to ensure that you're not enabling illegal activity. I'm not totally okay with what happened here, but I'm confident that it was not a "oops, sorry, we'll ban that botnet" situation. no-ip's primary use case is botnets, and they do have a responsibility to minimize botnet use. They can't claim ignorance given the widespread use.
sadfaceunread 12y ago
Anyone got a link to the TRO? Is this part of the public record?
- dlgeek 12y ago
  http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order%20-%20flattened.pdf http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order...
noipcom 12y ago
You can read No-IP's formal statement here: Thttps://www.noip.com/blog/2014/06/30/ips-formal-statement-microsoft-takedown/ https://www.noip.com/blog/2014/06/30/ips-formal-statement-mi...
- InAnEmergency 12y ago
  This is craziness.
jajaja2014 12y ago
microsoft now spying legitimate no-ip trafic based on non applicable us laws? fuck you microsoft!
notsoMicrosoft 12y ago
Appears as though Level 3's dns servers are still pointing where they should. 4.2.2.2 4.2.2.3 4.2.2.4
xxdesmus 12y ago
So based on Microsoft's ingenious logic someone could get a court order and take over part of their business because they have so many infected Windows XP machines out there. Right?
gtirloni 12y ago
1 - Court seems to quick to grant Microsoft control of the domains 2 - No-IP statement that they have an open channel with Microsoft executives but never (never?) received a complain from MS about any malicious activity is doubtful (sure MS can produce evidence to the contrary) 3 - What was the urgency and how was this presented to the judge? Personally I don't feel the urgency to use a takeover maneuver in this case, but is there information that shows the impact of not acting was too great? 4 - Our governments are so inept at fighting cyber-crime that instead of sending the request to a govt-regulated cyber-security unit they had to trust Microsoft's with the enforcement? That's sad. Like others, I am uneasy but thankful to MS. Just wish more details would be shared.
- zanny 12y ago
  > - Our governments are so inept at fighting cyber-crime that instead of sending the request to a govt-regulated cyber-security unit they had to trust Microsoft's with the enforcement? That's sad. If this were true, I could sleep easier at night. I doubt it - the judge in question was probably just paid off or otherwise influenced to give MS just insane power, while probably being ignorant of networking in the first place. I can't think of a software problem that is best served through the violent arm of the state.
  - MBCook 12y ago
    > the judge in question was probably just paid off or otherwise influenced That's a hell of an accusation.
    - ntakasaki 12y ago
      I guess you haven't been reading comments and articles on Slashdot, Groklaw and even HN over the years. Such wild accusations against MS are the norm. If you want a good chuckle, read this "article" and comments. http://tech.slashdot.org/story/09/02/16/2259257/draconian-drm-revealed-in-windows-7 http://tech.slashdot.org/story/09/02/16/2259257/draconian-dr...
      - 12y ago
marcelocamanho 12y ago
Oh.. That explains the issues we were having today. This seems to be affecting our no-ip even when we have no malware or threat.
bluejellybean 12y ago
Holy fuck... if this doesn't get solved my company is dead in the water...
- moblahbl4hblah 12y ago
  I'm sorry man, but if your business is predicated on a free dynamic dns provider? Do I even have to finish that statement?
moe 12y ago
Wouldn't it make more sense to make Microsoft financially liable for damages caused by their continued [criminal?] negligence? [1] http://www.zdnet.com/after-seven-months-and-no-microsoft-patch-internet-explorer-8-vulnerability-is-revealed-7000029765/ http://www.zdnet.com/after-seven-months-and-no-microsoft-pat... [2] http://www.microsoftproductreviews.com/microsoft-news/internet-explorer-8-security-flaw-remains-unfixed-need-worry/ http://www.microsoftproductreviews.com/microsoft-news/intern...
rippa242 12y ago
I'm wondering how Microsoft managed to take down the noip.me base domain, since the court stated (footnote 1 on page 5 of the 2nd amended TRO, 2:14-cv-00987-GMN-GWF-019) that the noip.me domain is controlled by the country of Montenegro and outside US legal system control. While there are noip.me 3rd level domains in Appendix A of the TRO, mine were NOT listed and yet I'm being sinkholed by Microsoft.
jrs235 12y ago
So on a different side topic, if the service was free and I assume the TOS from noip didn't guarantee an SLA, does this mean all the end users are basically out of Luke suing Microsoft for failure to properly resolve their domains? If the cliche isn't true, then I guess the next/new one is, if its free you're SOL.
johnnyxp64 12y ago
what the fuck is wrong with the world this days!!!??? are you all in prison because few morons stole something??? wtf Microsoft is wrong with you and you damn courts!???? i will sue you bastards because i am loosing money due to your stupid actions!!!!
Nanzikambe 12y ago
There are serious problems with this, firstly that it's technically impossible to implement effectively, beyond that it's extremely impractical. Any benefit will be so so transient as to render the entire exercise pointless. For the moment, let us ignore the scary implications of the court's part in this and consider this from a technical perspective in a logical manner: The hypothetical sub-domain abc.no-ip.org resolves to 1.2.3.4, a host somewhere that contains malicious payloads, is botnet C&C or is a member of a botnet. In any case, he's the bad guy - one of the people Microsoft are looking to exclude from the Internet. So how can this be accomplished? Let's ignore for the moment that the bad guys are free to use any other dyndns service they please and assume that no-ip is the only one. Approach 1 ---------- Every time a host connects to no-ip to update its IP, Microsoft scans tcp & udp ports of the host looking for known C&C services, scans hosted data (public web or ftp). This will simply result in the bad guys hiding all of this in an undetectable manner, many bot-nets already use either Tor or SSH for C&C - without authentication it will be impossible to differentiate Joe Average with an SSH or Tor exit from the "targets". As for scanning for content, this is possible assuming the content has to be public (ie. malicious payload) but even then, it's not practical - payloads can be hidden in anything and obfuscated beyond detection. Essentially all that's accomplished is another arms race based around signature detection for malicious content, with the disadvantage that unlike AV solutions this scanning is conducted remotely and the scan source is known. So the malicious guy with 2 or three lines just uses a stateful firewall to point microsoft's "scanning service" to good content, everyone else to the bad. So what other options are there? A blacklist of IPs? Well, they're dynamic IPs, sooner or later you'll end up with every dynamic IP in the entire ipv4 range blacklisted as the bad dudes just release/renew. Then there's banning the sub-domains/users! Also impractical because for each user and domain you ban, another will emerge. Approach 2 ---------- Microsoft resolves every request for abc.no-ip.org to their own service, all the time, this service performs stateful packet analysis before forwarding it on to the destination host. Impractical because you're essentially routing all no-ip traffic via Microsoft and once again you can only filter what you can detect -- and once the requests themselves are encrypted, that becomes impossible. This is effectively a MITM attack. All the while we've assumed no-ip is the only alternative, it's not - and many others are beyond Microsoft and the courts jurisdiction. So ultimately the only way this "approach" could be temporarily feasible is if all Internet traffic were routed through Microsoft's service. So effectively you need to give control of every domain, TLD, ipv4 and ipv6 range to Microsoft. Not workable. Someone is bound to point out that Microsoft's approach in this may be distributed, agents running on installs of their operating system which does address some aspects of my points above, but once again -- if Microsoft is capable of implementing effective detection on the workstation, remind me again why any of this is needed? I must be missing something fundamental.
saganus 12y ago
What I don't understand and haven't seen anyone ask is, why Microsoft? I mean, obviously some shady legal tactics are at work here, but why did Microsoft got to control those domains instead of, Mozilla for example? or Google? even more so, why wasn't control transferred to ICE for example? Not saying it's a better alternative or even that I agree with it, but it's very VERY unsettling (and I'm not even American) that a corporation can basically say "dibs on this" backed up by a court order! I would understand if the procedure went some more like, MS cries wolf, a court order is issued and a gov agency takes temporary control. At least it's "the government" doing the policing (even if guided by a corporation or whatever). What's next now? Comcast and Verizon sending their IP Police to arrest you because they have a log showing piracy was downloaded at an IP owned by you? And they get to seize your stuff and now your house is a Comcast/Verizon store? Wtf is this? It's so unreal. Edit: typo
- kevingadd 12y ago
  Our government has a pretty long track record of privatizing law enforcement (not to mention prisons, warfare, etc...) so it's not surprising to see this handed off to Microsoft. If anything, a company like MS, Google or Mozilla at least has the expertise to do a good job. Still not happy to see it, though.
  - saganus 12y ago
    I agree. But it's pretty strange that control was not given to the corresponding government authority. They could then have MS work as "consultants". I don't agree either, but at least that would have made some sort of sense. Maybe even better if it wasn't just one company but a panel of several institutions, including IETF for example, or something like that.
- danielweber 12y ago
  Apparently because Microsoft went to court to stop it. Google could have tried this, too.
  - saganus 12y ago
reality_czech 12y ago
People were starting to forget why everyone hates Microsoft. Even on this site, I see a lot of comments about how Microsoft "isn't so bad" anymore. Hopefully this will lay that and similar naive comments to rest.
sanbor 12y ago
If the way to prevent malware is by blocking domains (which only prevent a few of them), with the same logic another great solution would be blocking Microsoft's operating systems (which would prevent most of them). Ubuntu should ask the government the same power and show how little malware Ubuntu users has and how much Windows users has to suffer.
bobloblawblah 12y ago
I use no-ip in conjunction with my phone. I get within 200m of home and my home computer gets wakeonlan'ed. Today that didn't happen. I had originally blamed no-ip for this... To me, Microsoft seems to be the bully and is now actually guilty of conduct No-IP was only peripherally involved in.
teddyh 12y ago
I suddenly feel a lot better for having set up my own dynamic DNS solution. (Using plain Dynamic DNS and nsupdate(1) on the clients.)
dimman 12y ago
Do they want a thank you? So sad really because lately they've shown some small steps in what I thought was the right direction. Ignorance is bliss.
moblahbl4hblah 12y ago
All of you pant-shiting bitches...Oh Noes! MS took down a botnet...what's to stop the court from giving my TF2 hosting domain? Grow up. You guys bitch about malware. You bitch about MS. Mainly you just bitch...and talk about Haskell. It's boring.
motters 12y ago
So if I declare that the Bing web crawler is ignoring robots.txt and DDoSing my server then I can take over microsoft.com to "clean" out the bad stuff and redirect all traffic to zombo.com?
imrehg 12y ago
We are using a no-ip.biz address for the Taipei Hackerspace website (because need DynamicDNS due to stupid settings of our network provider). After the whole day it was still working, I thought we will be not affected. No such luck, microsoftinternetsafety.net took our address as well, and the website + all services associated is inaccessible. Thanks a lot, M$!
- moblahbl4hblah 12y ago
  Yeah, because who could have guessed that a free dynamic dns service would be used by malware...I mean, that's why I didn't use a proper dns hosting service...Come on! Who's got the 20$ a year for making sure that something they actually care about doesn't do down?
hd502 12y ago
Complete BS. They claimed they were just going to stop bad traffic. But they can't handle the overall traffic load and so NO traffic is getting through. I was using the service to provide access to an API server in-house. A very simple server, nothing but JSON requests in-and-out. Absolutely NO malware. But since MS takeover - no traffic has gotten through. I pay for my noip account, so I'm happy to join any lawsuits against MS for this action. Personally, I see a class action suit being VERY viable. I also have issue with the courts even allowing this. Did they do ANY research on what is actually going on? I can't see how they could let this happen. I feel violated!
Labrynth2014 12y ago
I would just add @andor, that the Police DO NOT own enough tools and equipment to do this. The Private sector has to, for better or for worse. I have domains with NO-IP and I've had no problem with them. It would all have been better had Microsoft made a statement about seizing the DNS but I respect the DON'T TELL THE ENEMY WE'RE COMING AND ON TO THEM !
Geiko 12y ago
So shouldn't Spamcop.net (or anyone else) be able to seize microsoft.com, outlook.com and hotmail.com. They have been blocking those email servers for years due to spam sent from their domains and email servers.
kurenyen 12y ago
I've spent years of efforts on my site, people like it, now it's unreachable, fuck you Microsoft...
vfclists 12y ago
When are a group of no-ip customers going to file a class action suit against Microsoft? Just because an ignorant judge gave them access to some no-ip domains did not give them the right bite more then they could che and fsck it up. The whole thing is just bizarre, WTF were they trying to accomplish? ie they took over the business of providing name service to over 4 million hosts, way bigger more than most large service providers with the intention of traffic to and from the C & C servers, or identify which of the computers were infected and inform their owners? Why didn't they simply set up some monitoring devices and get the judges or the FBI to compel no-ip to allow them to plug it into their network so they could monitor what they wanted without disrupting the service? If the no-ip owners were directly involved in the scam then why didn't the hand the evidence to the law enforcement authorities and let them carry on from there?

315 points by anExcitedBeast 12y ago

Has I understood this correctly? Microsoft, a private company, has been granted the right to filter all dns traffic, and choose what will bee forward to this other company, No-IP. No-IP will so bee allowed to run there service for the remaining customers Microsoft approves? Is this common practices in the us legal system? Would it work like this in the offline world also? If my neighbor sometimes had loud parties that bothered me, could I be granted the right to stand in front of his door and turn any potential troublemakers away.

lstamour 12y ago
It's a temporary restraining order. It obviously affects Microsoft's products and its customers. It would be equivalent to say, blocking a phone switch that was misbehaving and calling you continuously causing a denial of service attack. That Microsoft customers are suffering more than Microsoft itself and that No-IP appeared to be in denial seems to support the temporary restraining order -- No-IP, aware of such reports via blog posts, chooses to do nothing by asking for reports rather than investigating and stopping the behaviour themselves.
ntakasaki 12y ago
>If my neighbor sometimes had loud parties that bothered me, could I be granted the right to stand in front of his door What if they were bothering 7.4 million people and inconveniencing many more? And then didn't show up in court in spite of summons? The police or courts will take that far more seriously.
- deleted 12y ago
  [deleted]
- nitrogen 12y ago
  Microsoft is not the police or courts.
  - cpncrunch 12y ago
    It was the court that allowed Microsoft to do this.
    - serf 12y ago
      the court deciding that a company (Microsoft) should act as the police (or in this analogy, a bouncer) is still terribly short-sighted, especially when that company has been historically accused by the DOJ of attempting to form varying monopolies. a capable government should not be in the habit of contracting valuable state-needed cyber-defense to private companys, as the 'keys to the kingdom', in this case domain records, should not be in the hands of a company that can benefit privately but rather a state-ran agency which employs proper check and balances.
    - plaguuuuuu 12y ago
      A court appointed a private corporation to act as a police agency.
- alasdair_ 12y ago
  Hotmail.com and outlook.com are regularly used to send out malware. I know this because I have received some personally every couple of months for the last 4-5 years. It's highly likely that over the years, more that 7.4 million spam emails have been sent through Microsoft's systems. Under the bar set by this judge, I should be able to apply for, and receive, ownership of outlook.com based on the fact that Microsoft doesn't always rush to comply with emails that I send them. It won't happen, of course, because Microsoft has more money than I do (and because it's a fucking stupid idea). This is an appalling remedy and I hope Microsoft and the Judge in question face serious repercussions for it.
pjc50 12y ago
Is this common practices in the us legal system? Courts not understanding the social effects of technological law and making an order in favour of the more "respectable" looking party? Happens all the time.

nathanb 12y ago

So let me get this straight...Microsoft took down a free provider of dynamic DNS services because people have used those services to distribute and control malware? Where is the due process? Where is the oversight in this? All I'm seeing is vigilanteism.

andrewstuart2 12y ago
Court-authorized vigilantism.
- cwyers 12y ago
  By definition, if it's court-authorized, it's not vigilantism.
  - JacobEdelman 12y ago
    If a court legalizes Batman then its court authorized, but he's still not a publicly controlled entity and those still a vigilante.
    - MBCook 12y ago
      Vigilante. N. A member of a self-appointed group of citizens who undertake law enforcement in their community WITHOUT LEGAL AUTHROITY, typically because the legal agencies are thought to be inadequate.
    - wtracy 12y ago
      It's called "deputizing", and a deputy is not a vigilante pretty much by definition.
      - Dylan16807 12y ago
        The judiciary has the ability to deputize law enforcement? I thought those were supposed to have independent structure.
12y ago

deleted 12y ago

[deleted]

pktgen 12y ago

FWIW, in my experience, No-IP is very, very responsive and helpful to abuse complaints. Though that is the extent of my experience with them, I've never thought them to be actively harboring malicious activity (unlike, say, CloudFlare).

duskwuff 12y ago
While I'm not familiar with the exact situation here, I suspect the real problem is that the malware domains are being automatically created en masse, and No-IP have been slow or reluctant to do anything to slow that down. Being responsive to complaints is good for small-scale problems involving individual domains, but basically useless for large-scale abuse.
- gcb0 12y ago
  what if a company like microsoft approach you and say "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" granted, i'm not familiar with the matter. but I know what I would answer. also, removing noip or noip enabling whatever microsoft was bullying them to implement, would just delay it a few days until the worm creators rolled out their own service. heck that can even motivate them to get creative and encode IPs in a obfuscated pastebin, or stenographed in cat pictures in reddit, or noise mp3 in soundcloud... maybe having them rely on noip was good.... but again, i have no knowledge of the matter. maybe noip was being paid even after knowing it was for worms. who knows?
  - wfjackson 12y ago
    > "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" How can they patch it in their product without turning desktop Windows into something like iOS or Windows Phone/RT? Even Android has a ton of malware so the notion that Windows is somehow more hole ridden than other platforms stopped being true starting about 10 years ago with their Secure computing initiative. If the user can install Firefox, they can install malware. If Firefox doesn't need to get permission from MS for their next version, Windows cannot distinguish between Firefox.exe and Codec_Flash_Shady.exe. Sandboxing will disable system level utilities. MS is capable of making secure OSes. How many viruses and trojans do the 3 Xboxes, Windows Phone and RT have? Even Windows Server is pretty secure(atleast as secure as Linux) unless the admins start browsing on it. Malware is a real threat to any popular OS unless third party apps are entirely blocked or restricted by the use of a approval based App Store. Windows gives much more control to the user, which is why many users are able to stay away from infections. And it's ironic that you're blaming MS here instead of the folks that propagate it(including a YC company https://www.techdirt.com/articles/20130115/17343321692/why-are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml https://www.techdirt.com/articles/20130115/17343321692/why-a...) and people who install it(users). Remember the shitstorm that was raised against MS on here and elsewhere when they tried to secure users by preventing undetectable rootkits by enabling Secure Boot?

kqr2 12y ago

Any alternatives for free dynamic DNS?

pstatho 12y ago
afraid.org is a good alternative.
nvr219 12y ago
Hurricane Electric: https://dns.he.net/ https://dns.he.net/
- makmanalp 12y ago
  Whoa, he.net is alive and kicking. These guys used to run an efnet server back in the day.
  - lucb1e 12y ago
    And I heard they do free IPv6 tunnels. Pretty cool.
    - kordless 12y ago
      HE is awesome.
timdorr 12y ago
I've been using http://freedns.afraid.org/ http://freedns.afraid.org/ ever since DynDNS went paid only.
andrewstuart2 12y ago
If you own a domain name, a lot of registrars let you query some https endpoint to update DNS, which you can plug into firmware like DD-WRT. Namecheap, for one, does. I know this because I did it this morning after no-ip stopped working for me.

tokenizerrr 12y ago

So does this mean no-ip.com is no more, or only a subset of their domains?

lstamour 12y ago
It means, temporarily, a subset of traffic known to be from these viruses should be blocked, within part of the US, it seems.
- tokenizerrr 12y ago
  Being in the Netherlands I can confirm that I got the same results as https://news.ycombinator.com/item?id=7967853 https://news.ycombinator.com/item?id=7967853, so not just the US.
- andrewcooke 12y ago
  it's more than that. i cannot get to my (presumably clean, running linux, carefully maintained) home machine situated in chile, connecting from the uk.
dougaa 12y ago
No-ip is operational, but no longer handles the 22 domains Microsoft took over. I use no-ip's DNS for a domain name that's registered somewhere else, and it's unaffected. From what I read somewhere else, the reason legitimate domain names are being affected is because Microsoft's servers can't handle the load.

norswap 12y ago

Just when you thought it had been a long time since Microsoft was last evil.

deleted 12y ago
[deleted]

ars 12y ago

Wait what? If I have a domain with no-ip.com will it continue to work? Does Microsoft effectively own them now?

blacksmith_tb 12y ago
Mine is not working.
davidu 12y ago
They domain will work, subdomains on at least no-ip.biz and no-ip.org aren't going to work.

Zancarius 12y ago

> On June 26, the court granted our request and made Microsoft the DNS authority for the company’s 23 free No-IP domains, allowing us to identify and route all known bad traffic to the Microsoft sinkhole and classify the identified threats. Something about this bothers me. So the courts granted MS the rights to essentially take over No-IP's DNS in order to "identify" ... "bad traffic?" The implications of this are... chilling. As much as I want to reserve judgement, this makes me uneasy (malware aside).

informatimago 12y ago
Don't use .com, .net, .org, .edu; use domain names in your own sovereignty! Microsoft would have it much harder to get no-ip.ru or no-ip.zh (granted, a little easier grabbing no-ip.fr).
DINKDINK 12y ago
https://en.wikipedia.org/wiki/Namecoin https://en.wikipedia.org/wiki/Namecoin Distributed DNS is the only solution
- zanny 12y ago
  And meshnets. DNS is just a layer on top of an already vulnerable IP stack. IP can work between broad and anonymous mesh nets, but when an IP address can be resolved to a business or person it provides an exploit vector.
  - walden42 12y ago
    Like MaidSafe? Are there other alternatives?
- dsl 12y ago
  So malware authors will be able to operate with impunity? As in all things, the solution is somewhere in the middle.
- livingparadox 12y ago
  It doesn't serve No-IP's market, because No-IP is for frequently changing IP addresses. Namecoin charges for each record change, to my knowledge.

vfclists 12y ago

Loads of self-congratulating tripe. Microsoft why don't you simply provide free OS upgrades or fixes for the millions of XP computers out there? They are not going anywhere soon. Next thing we know your lawyers and lobbyists are going to come up with some legislative wheeze and you will be running the biggest botnet in the world. You created the problem so fix it yourself.

vfclists 12y ago
Wholly predictable downvoting by anonymously cowardly Microsoft brown-nosers.
- TallGuyShort 12y ago
  Fine. I downvoted you, and it's no longer anonymous. I downvoted you because both of your comments were filled with passionate garbage rather than any well-reasoned thought. I'd be willing to bet other downvoters were not simply cowardly Microsoft brown-nosers.
  - spion 12y ago
    Its hard to stay calm if you were relying on no-ip's services for very legitimate purposes. Maybe the action coming from Microsoft is whats garbage - not the resulting emotional outbursts.
  - vfclists 12y ago
    Which ever way you cut it technically speaking Microsoft runs the biggest botnet because they have control all the computers running Windows upgrade, and if they can't shut them down, they might as well fix them. Whether you like it or not for better or worse a botnet is an economic resource whose value is not lost on Microsoft and sooner or later they are going to come up with a wheeze to exploit them.
    - kordless 12y ago
      You are missing the point. He said why he downvoted you and you replied with a general rationalization on why he should agree with you, when that's entirely NOT the point. You'll catch more flies with honey than you will with vinegar. We probably all agree with you in some fashion, just not the way you put it. And, just in case YOU can't figure it out, the blaming statements you are making are due to the use of 'you' in your comment.

alasdair_ 12y ago

"On June 19, Microsoft filed for an ex parte temporary restraining order (TRO) from the U.S. District Court for Nevada against No-IP. On June 26, the court granted our request and made Microsoft the DNS authority for the company’s 23 free No-IP domains, allowing us to identify and route all known bad traffic to the Microsoft sinkhole and classify the identified threats. " How can this be legal? Does this mean that if I get malware from a hotmail.com address, I can file for a TRO against Microsoft and control their domains? I honestly don't understand why Microsoft should be given this ability.

tptacek 12y ago
It's an ex parte order, so presumably Vitalwerks didn't show up in court despite the summons? If you filed for a TRO against Microsoft and their lawyers ignored it, something bad might happen to them too.
- starik36 12y ago
  Ex parte order can be given even if Vitalwerks does show up (source: divorce court). Ex-parte simply means that it was an emergency and couldn't wait. However, it also means that a new full hearing has been setup (likely in 2 weeks or so) where both parties can argue their case. The full decision will be taken then.
- bradleyjg 12y ago
  Ex parte means "from (by or for) one party", the judge acts upon the moving party's request without hearing from the other party. They are supposed to be rare and meet a high bar -- generally involving emergencies (and occasionally involving actions that need to remain secret). Given that the allegations span many months, it's hard to see how it was an appropriate form of action here. I'd be very interested to see if there was a written decision granting the TRO. Edit: This appears to be it http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order%20-%20flattened.pdf http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order...
  - giancarlostoro 12y ago

andrewstuart2 12y ago

So let me get this straight. Microsoft got a court order to route all of another entity's DNS traffic to their servers. Giving them the ability to route a metric crap-ton of private traffic through their data centers. For "security". I call shenanigans. I'm also assuming this is why my no-ip domain disappeared this morning, leaving me with no access to my home servers. Perhaps the linux on my servers is considered malware. It sure is malicious to Microsoft's bottom line. I kid, but only a little.

robert_nsu 12y ago
Not exactly. > allowing us to identify and route all known bad traffic to the Microsoft sinkhole and classify the identified threats. According to MSFT, they are only looking at known "bad" traffic. You can take their word for it... or not.
- pbhjpbhj 12y ago
  If that last line were true then surely the GP's noip domain would still work and traffic would be routing without any interference. Ergo, they are telling lies as they are not simply routing "bad traffic" elsewhere but also "good traffic".
- marcosdumay 12y ago
  How do they know that some data is "bad" before looking at it? And I'm asking only because I know the answer - that it's impossible, they are looking at the entire traffic and (officially) deciding if it's "bad" afterwards.
- hendersoon 12y ago
  That's what they said, but that is not what happened. They couldn't handle the load and every noip hostname stopped working. Every one.

nostromo 12y ago

According to Reuters, Microsoft is only sending traffic from computers that are infected with malware to Microsoft instead of No-IP. http://uk.reuters.com/article/2014/06/30/us-cybercrime-microsoft-idUKKBN0F52A920140630 http://uk.reuters.com/article/2014/06/30/us-cybercrime-micro... That may still make people uncomfortable, but it seems much less egregious than Microsoft taking control of No-IP's domains, which is what this press release implies. Edit: the reuters article is in error here, not the Microsoft Blog. See below. Turns out this really is as egregious as it sounds.

andrewstuart2 12y ago
> Microsoft is only sending traffic from computers that are infected to Microsoft instead of No-IP. Unfortunately that's false. See below: dig -t ns no-ip.biz ; <<>> DiG 9.9.2-P2 <<>> -t ns no-ip.biz ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7020 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;no-ip.biz. IN NS ;; ANSWER SECTION: no-ip.biz. 7154 IN NS ns8.microsoftinternetsafety.net. no-ip.biz. 7154 IN NS ns7.microsoftinternetsafety.net. ;; ADDITIONAL SECTION: ns8.microsoftinternetsafety.net. 3560 IN A 157.56.78.93 ;; Query time: 3 msec ;; SERVER: 10.1.1.3#53(10.1.1.3) ;; WHEN: Mon Jun 30 14:14:47 2014 ;; MSG SIZE rcvd: 117
- nostromo 12y ago
  What DNS are you using? On Google (8.8.8.8) or Comcast DNS I'm not seeing this for their top domains (no-ip.org, no-ip.biz, no-ip.info). I wonder if your ISP is working with Microsoft.
  - lstamour 12y ago
    It's strange, I've yet to see it too, in Canada. Must be within a limited area for the ISP, or thanks to the collaboration with A10 Networks. E.g. https://www.whatsmydns.net/#NS/no-ip.com https://www.whatsmydns.net/#NS/no-ip.com
  - 12y ago

sakawa 12y ago

I guess this is a shortcut to solve some problems. No-IP domains are used only by who hasn't a good infrastructure to support his infected network. And especially, why don't Microsoft take care of making his OS more secure?

davidu 12y ago

This is an incredible action by Microsoft, and the courts.

andmarios 12y ago

Which dynamic DNS service will be next? But I have a better idea. Windows are an easy target for cybercriminals; maybe someone should step up and take Microsoft down.

diminoten 12y ago
What kind of a thug do you have to be to think like this?
- andmarios 12y ago
  A microsoft employee probably.
andmarios 12y ago
Funny how I got all this downvoting because I used the exact same phrase as Microsoft did in their blog post to justify why they took down noip domains. Microsoft wrote “Free Dynamic DNS is an easy target for cybercriminals”. Are my concerns that more free dynamic DNS services will follow unfounded?

mschuster91 12y ago

Just ran a dig +trace on no-ip.biz. Just... wtf. Who had acted upon that court order?! I thought that the days the US had full control over the internet were LONG past. ` biz. 172800 IN NS a.gtld.biz. biz. 172800 IN NS b.gtld.biz. biz. 172800 IN NS c.gtld.biz. biz. 172800 IN NS e.gtld.biz. biz. 172800 IN NS f.gtld.biz. biz. 172800 IN NS k.gtld.biz. ;; Received 308 bytes from 192.203.230.10#53(192.203.230.10) in 526 ms no-ip.biz. 7200 IN NS NS7.MICROSOFTINTERNETSAFETY.NET. no-ip.biz. 7200 IN NS NS8.MICROSOFTINTERNETSAFETY.NET. ;; Received 90 bytes from 209.173.58.66#53(209.173.58.66) in 150 ms no-ip.biz. 76834 IN NS nf5.no-ip.com. no-ip.biz. 76834 IN NS nf2.no-ip.com. no-ip.biz. 76834 IN NS nf4.no-ip.com. no-ip.biz. 76834 IN NS nf3.no-ip.com. no-ip.biz. 76834 IN NS nf1.no-ip.com. ;; Received 206 bytes from 157.56.78.73#53(157.56.78.73) in 344 ms

jauer 12y ago
"full control over the internet" is distinct from control over US corporations. Dot biz is operated by Neustar and they are based in Virginia and thus subject to US Courts. For example, they likely would have had less success enforcing a change on a .ir domain as the registry isn't located in US jurisdiction.
- mschuster91 12y ago
  I bet that the US were not above to forcing the root DNS server providers to redirect the NS for .ir to some 3-letter-agency.

spion 12y ago

This is quite outrageous. I've been using no-ip.com for very legitimate purposes and this will surely result with a lot of breakage. Thanks Microsoft. Thanks a lot.

Omniusaspirer 12y ago
As another completely legitimate user what strikes me the most with this is how they did their best to basically pull off a sneak attack. I mean really? Microsoft just couldn't be bothered to give any forewarning to the millions of customers who's services they were directly interfering with? Tack on the dubious reasoning and the alleged failure to even contact NOIP at all before having this court order issued and this puts Microsoft in a really bad light. I'm not mad at NOIP about malware (frankly- I don't give a single shit), but I'm absolutely mad at Microsoft for pulling this bullshit and interfering with services I paid for completely out of nowhere.
- spion 12y ago
  Indeed. Luckily I have a domain: now I'm going to fix this by setting up a CNAME and an account at another dyndns provider. Now if the other provider goes down, it should be possible to quickly make a switch without changing it in 1000 places* Should've thought of this earlier. Well, hindsight is 20/20 * includes git remote configuration, configuration files, scripts, bookmarked/saved links, and the worst: other people's links.
- hendersoon 12y ago
  Well, for "bulletproof" hosters that really are complicit in their customers' activities, you need to pull a sneak attack, so the bad actors don't have the chance to switch hosts. So I'm fine with that part of it. I'm not fine with classifying noip as complicit. It's not.

deniska 12y ago

And I was wondering, why did my no-ip.biz subdomain stop working…

tokenizerrr 12y ago
So they are not even forwarding legitimate traffic? Did they just take the entire company down?
- smellf 12y ago
  It looks like it to me - I have personal services running through them as well and my stuff stopped working last week. Of course, I also had multiple concurrent hardware failures, so I was assuming it was just that.

rblatz 12y ago

Their status twitter is interesting, they aren't going into any details as to why their service stopped working, and they haven't made any statements about the accusations against them. https://twitter.com/NoIPStatus https://twitter.com/NoIPStatus

hendersoon 12y ago
No-ip's official response is here: https://www.noip.com/blog/2014/06/30/ips-formal-statement-microsoft-takedown/ https://www.noip.com/blog/2014/06/30/ips-formal-statement-mi...
- rblatz 12y ago
  Thanks, I checked their site and they had not posted a response when I commented.

hendersoon 12y ago

It's just plain outrageous that this court order was granted. It essentially puts no-ip out of business when they were not complicit in anything illegal. It took me 5 minutes to switch my completely legitimate hosts over to ddns.net. I'm sure the evil botnet owners have backup hostnames and will do the same, or more likely switch to another provider entirely. The end result will be a short-lived dip in criminal activity over the next 72 hours or so, inconveniencing many thousands of legit users, and putting a completely innocent company out of business. Nice move, MS.

dsl 12y ago
No-ip was complicit in the illegal activity. If you use a car wash that is also laundering money, your legitimate need for a clean car is not a defense against shutting the business down.
- regd005 12y ago
  So if some number of people use cars for illegal activities should we shut down the gas stations that they use to fuel them?
- Omniusaspirer 12y ago
  But that's an awful analogy and frankly you should be ashamed for even trying to paint it in that light. NOIP did nothing illegal whatsoever, their only "crime" was that they didn't do enough about malware distribution to keep Microsoft happy- which last I heard wasn't illegal. To use your car wash analogy, it's more like the car wash unknowingly washed the car of a drug trafficker and then was essentially put out of business the next day for being "complicit in the illegal activity".
  - lukeschlather 12y ago
    I am uneasy about this situation, but the car wash in question is more like the car painting shop in Grand Theft Auto. Even if painting cars is a legitimate activity, when 75% of your customers are trying to mask illegal activity you should be doing some due diligence to ensure that you're not enabling illegal activity. I'm not totally okay with what happened here, but I'm confident that it was not a "oops, sorry, we'll ban that botnet" situation. no-ip's primary use case is botnets, and they do have a responsibility to minimize botnet use. They can't claim ignorance given the widespread use.

sadfaceunread 12y ago

Anyone got a link to the TRO? Is this part of the public record?

dlgeek 12y ago
http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order%20-%20flattened.pdf http://www.noticeoflawsuit.com/docs/Second%20Amended%20Order...

noipcom 12y ago

You can read No-IP's formal statement here: Thttps://www.noip.com/blog/2014/06/30/ips-formal-statement-microsoft-takedown/ https://www.noip.com/blog/2014/06/30/ips-formal-statement-mi...

InAnEmergency 12y ago
This is craziness.

jajaja2014 12y ago

microsoft now spying legitimate no-ip trafic based on non applicable us laws? fuck you microsoft!

notsoMicrosoft 12y ago

Appears as though Level 3's dns servers are still pointing where they should. 4.2.2.2 4.2.2.3 4.2.2.4

xxdesmus 12y ago

So based on Microsoft's ingenious logic someone could get a court order and take over part of their business because they have so many infected Windows XP machines out there. Right?

gtirloni 12y ago

1 - Court seems to quick to grant Microsoft control of the domains 2 - No-IP statement that they have an open channel with Microsoft executives but never (never?) received a complain from MS about any malicious activity is doubtful (sure MS can produce evidence to the contrary) 3 - What was the urgency and how was this presented to the judge? Personally I don't feel the urgency to use a takeover maneuver in this case, but is there information that shows the impact of not acting was too great? 4 - Our governments are so inept at fighting cyber-crime that instead of sending the request to a govt-regulated cyber-security unit they had to trust Microsoft's with the enforcement? That's sad. Like others, I am uneasy but thankful to MS. Just wish more details would be shared.

zanny 12y ago
> - Our governments are so inept at fighting cyber-crime that instead of sending the request to a govt-regulated cyber-security unit they had to trust Microsoft's with the enforcement? That's sad. If this were true, I could sleep easier at night. I doubt it - the judge in question was probably just paid off or otherwise influenced to give MS just insane power, while probably being ignorant of networking in the first place. I can't think of a software problem that is best served through the violent arm of the state.
- MBCook 12y ago
  > the judge in question was probably just paid off or otherwise influenced That's a hell of an accusation.
  - ntakasaki 12y ago
    I guess you haven't been reading comments and articles on Slashdot, Groklaw and even HN over the years. Such wild accusations against MS are the norm. If you want a good chuckle, read this "article" and comments. http://tech.slashdot.org/story/09/02/16/2259257/draconian-drm-revealed-in-windows-7 http://tech.slashdot.org/story/09/02/16/2259257/draconian-dr...
    - 12y ago

marcelocamanho 12y ago

Oh.. That explains the issues we were having today. This seems to be affecting our no-ip even when we have no malware or threat.

bluejellybean 12y ago

Holy fuck... if this doesn't get solved my company is dead in the water...

moblahbl4hblah 12y ago
I'm sorry man, but if your business is predicated on a free dynamic dns provider? Do I even have to finish that statement?

moe 12y ago

Wouldn't it make more sense to make Microsoft financially liable for damages caused by their continued [criminal?] negligence? [1] http://www.zdnet.com/after-seven-months-and-no-microsoft-patch-internet-explorer-8-vulnerability-is-revealed-7000029765/ http://www.zdnet.com/after-seven-months-and-no-microsoft-pat... [2] http://www.microsoftproductreviews.com/microsoft-news/internet-explorer-8-security-flaw-remains-unfixed-need-worry/ http://www.microsoftproductreviews.com/microsoft-news/intern...

rippa242 12y ago

I'm wondering how Microsoft managed to take down the noip.me base domain, since the court stated (footnote 1 on page 5 of the 2nd amended TRO, 2:14-cv-00987-GMN-GWF-019) that the noip.me domain is controlled by the country of Montenegro and outside US legal system control. While there are noip.me 3rd level domains in Appendix A of the TRO, mine were NOT listed and yet I'm being sinkholed by Microsoft.

jrs235 12y ago

So on a different side topic, if the service was free and I assume the TOS from noip didn't guarantee an SLA, does this mean all the end users are basically out of Luke suing Microsoft for failure to properly resolve their domains? If the cliche isn't true, then I guess the next/new one is, if its free you're SOL.

johnnyxp64 12y ago

what the fuck is wrong with the world this days!!!??? are you all in prison because few morons stole something??? wtf Microsoft is wrong with you and you damn courts!???? i will sue you bastards because i am loosing money due to your stupid actions!!!!

Nanzikambe 12y ago

There are serious problems with this, firstly that it's technically impossible to implement effectively, beyond that it's extremely impractical. Any benefit will be so so transient as to render the entire exercise pointless. For the moment, let us ignore the scary implications of the court's part in this and consider this from a technical perspective in a logical manner: The hypothetical sub-domain abc.no-ip.org resolves to 1.2.3.4, a host somewhere that contains malicious payloads, is botnet C&C or is a member of a botnet. In any case, he's the bad guy - one of the people Microsoft are looking to exclude from the Internet. So how can this be accomplished? Let's ignore for the moment that the bad guys are free to use any other dyndns service they please and assume that no-ip is the only one. Approach 1 ---------- Every time a host connects to no-ip to update its IP, Microsoft scans tcp & udp ports of the host looking for known C&C services, scans hosted data (public web or ftp). This will simply result in the bad guys hiding all of this in an undetectable manner, many bot-nets already use either Tor or SSH for C&C - without authentication it will be impossible to differentiate Joe Average with an SSH or Tor exit from the "targets". As for scanning for content, this is possible assuming the content has to be public (ie. malicious payload) but even then, it's not practical - payloads can be hidden in anything and obfuscated beyond detection. Essentially all that's accomplished is another arms race based around signature detection for malicious content, with the disadvantage that unlike AV solutions this scanning is conducted remotely and the scan source is known. So the malicious guy with 2 or three lines just uses a stateful firewall to point microsoft's "scanning service" to good content, everyone else to the bad. So what other options are there? A blacklist of IPs? Well, they're dynamic IPs, sooner or later you'll end up with every dynamic IP in the entire ipv4 range blacklisted as the bad dudes just release/renew. Then there's banning the sub-domains/users! Also impractical because for each user and domain you ban, another will emerge. Approach 2 ---------- Microsoft resolves every request for abc.no-ip.org to their own service, all the time, this service performs stateful packet analysis before forwarding it on to the destination host. Impractical because you're essentially routing all no-ip traffic via Microsoft and once again you can only filter what you can detect -- and once the requests themselves are encrypted, that becomes impossible. This is effectively a MITM attack. All the while we've assumed no-ip is the only alternative, it's not - and many others are beyond Microsoft and the courts jurisdiction. So ultimately the only way this "approach" could be temporarily feasible is if all Internet traffic were routed through Microsoft's service. So effectively you need to give control of every domain, TLD, ipv4 and ipv6 range to Microsoft. Not workable. Someone is bound to point out that Microsoft's approach in this may be distributed, agents running on installs of their operating system which does address some aspects of my points above, but once again -- if Microsoft is capable of implementing effective detection on the workstation, remind me again why any of this is needed? I must be missing something fundamental.

saganus 12y ago

What I don't understand and haven't seen anyone ask is, why Microsoft? I mean, obviously some shady legal tactics are at work here, but why did Microsoft got to control those domains instead of, Mozilla for example? or Google? even more so, why wasn't control transferred to ICE for example? Not saying it's a better alternative or even that I agree with it, but it's very VERY unsettling (and I'm not even American) that a corporation can basically say "dibs on this" backed up by a court order! I would understand if the procedure went some more like, MS cries wolf, a court order is issued and a gov agency takes temporary control. At least it's "the government" doing the policing (even if guided by a corporation or whatever). What's next now? Comcast and Verizon sending their IP Police to arrest you because they have a log showing piracy was downloaded at an IP owned by you? And they get to seize your stuff and now your house is a Comcast/Verizon store? Wtf is this? It's so unreal. Edit: typo

kevingadd 12y ago
Our government has a pretty long track record of privatizing law enforcement (not to mention prisons, warfare, etc...) so it's not surprising to see this handed off to Microsoft. If anything, a company like MS, Google or Mozilla at least has the expertise to do a good job. Still not happy to see it, though.
- saganus 12y ago
  I agree. But it's pretty strange that control was not given to the corresponding government authority. They could then have MS work as "consultants". I don't agree either, but at least that would have made some sort of sense. Maybe even better if it wasn't just one company but a panel of several institutions, including IETF for example, or something like that.
danielweber 12y ago
Apparently because Microsoft went to court to stop it. Google could have tried this, too.
- saganus 12y ago

reality_czech 12y ago

People were starting to forget why everyone hates Microsoft. Even on this site, I see a lot of comments about how Microsoft "isn't so bad" anymore. Hopefully this will lay that and similar naive comments to rest.

sanbor 12y ago

If the way to prevent malware is by blocking domains (which only prevent a few of them), with the same logic another great solution would be blocking Microsoft's operating systems (which would prevent most of them). Ubuntu should ask the government the same power and show how little malware Ubuntu users has and how much Windows users has to suffer.

bobloblawblah 12y ago

I use no-ip in conjunction with my phone. I get within 200m of home and my home computer gets wakeonlan'ed. Today that didn't happen. I had originally blamed no-ip for this... To me, Microsoft seems to be the bully and is now actually guilty of conduct No-IP was only peripherally involved in.

teddyh 12y ago

I suddenly feel a lot better for having set up my own dynamic DNS solution. (Using plain Dynamic DNS and nsupdate(1) on the clients.)

dimman 12y ago

Do they want a thank you? So sad really because lately they've shown some small steps in what I thought was the right direction. Ignorance is bliss.

moblahbl4hblah 12y ago

All of you pant-shiting bitches...Oh Noes! MS took down a botnet...what's to stop the court from giving my TF2 hosting domain? Grow up. You guys bitch about malware. You bitch about MS. Mainly you just bitch...and talk about Haskell. It's boring.

motters 12y ago

So if I declare that the Bing web crawler is ignoring robots.txt and DDoSing my server then I can take over microsoft.com to "clean" out the bad stuff and redirect all traffic to zombo.com?

imrehg 12y ago

We are using a no-ip.biz address for the Taipei Hackerspace website (because need DynamicDNS due to stupid settings of our network provider). After the whole day it was still working, I thought we will be not affected. No such luck, microsoftinternetsafety.net took our address as well, and the website + all services associated is inaccessible. Thanks a lot, M$!

moblahbl4hblah 12y ago
Yeah, because who could have guessed that a free dynamic dns service would be used by malware...I mean, that's why I didn't use a proper dns hosting service...Come on! Who's got the 20$ a year for making sure that something they actually care about doesn't do down?

hd502 12y ago

Complete BS. They claimed they were just going to stop bad traffic. But they can't handle the overall traffic load and so NO traffic is getting through. I was using the service to provide access to an API server in-house. A very simple server, nothing but JSON requests in-and-out. Absolutely NO malware. But since MS takeover - no traffic has gotten through. I pay for my noip account, so I'm happy to join any lawsuits against MS for this action. Personally, I see a class action suit being VERY viable. I also have issue with the courts even allowing this. Did they do ANY research on what is actually going on? I can't see how they could let this happen. I feel violated!

Labrynth2014 12y ago

I would just add @andor, that the Police DO NOT own enough tools and equipment to do this. The Private sector has to, for better or for worse. I have domains with NO-IP and I've had no problem with them. It would all have been better had Microsoft made a statement about seizing the DNS but I respect the DON'T TELL THE ENEMY WE'RE COMING AND ON TO THEM !

Geiko 12y ago

So shouldn't Spamcop.net (or anyone else) be able to seize microsoft.com, outlook.com and hotmail.com. They have been blocking those email servers for years due to spam sent from their domains and email servers.

kurenyen 12y ago

I've spent years of efforts on my site, people like it, now it's unreachable, fuck you Microsoft...

vfclists 12y ago

When are a group of no-ip customers going to file a class action suit against Microsoft? Just because an ignorant judge gave them access to some no-ip domains did not give them the right bite more then they could che and fsck it up. The whole thing is just bizarre, WTF were they trying to accomplish? ie they took over the business of providing name service to over 4 million hosts, way bigger more than most large service providers with the intention of traffic to and from the C & C servers, or identify which of the computers were infected and inform their owners? Why didn't they simply set up some monitoring devices and get the judges or the FBI to compel no-ip to allow them to plug it into their network so they could monitor what they wanted without disrupting the service? If the no-ip owners were directly involved in the scam then why didn't the hand the evidence to the law enforcement authorities and let them carry on from there?