8 ms·

Update to Microsoft Takedown – Domains Fully Restored

104 points by thefreeman 12y ago

z92 12y ago
Has Microsoft gained from this fiasco, or lost? Not sure.
- Guvante 12y ago
  I haven't seen heavy technical details on what the seizure involved, but if in theory they got a hold of some control domains they could have sent out kill commands to stop the malware from working or alternatively sent them to a static "do nothing" host.
  - ntakasaki 12y ago
    According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour. http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/ http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-b... >However since hackers add new domain names every hour, 100+ new hostnames need to be blocked. I’ve sent a few updates to both services, but they haven’t yet responded and I guess we’ll need to wait until Monday when they get back to work.
    - dublinben 12y ago
      Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.
      - justsomedood 12y ago
        I'm sure they're using compromised hosts for the servers, which would change pretty often
      - nucleardog 12y ago
        How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
        dublinben 12y ago
        Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
        nucleardog 12y ago
        It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
      - superuser2 12y ago
        Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?
- Alupis 12y ago
  Microsoft seized the domains in order to discover command-and-control servers of a few botnets. Now... whether or not Microsoft seizing another legitimate company's property without any notice is legal/ethical is another question (one that probably should get more attention).
  - joe_the_user 12y ago
    What is the justification of this post being pretty severely downvoted? It's not intemperate or off-topic as far as I can tell. Go ahead and downvote me too for metacommenting but it seems like slaps being handed out so freely just degrades community by making people reluctant to comment.
    - deleted 12y ago
      [deleted]
    - wfjackson 12y ago
      Your parent poster did a :s/M$/Microsoft on that comment before you read it. Edit: They then replied to your post with "I was wondering the same thing", before reading my post and deleting that comment.
      - deleted 12y ago
        [deleted]
        jabits 12y ago
        "M$" is a shorthand for "Microsoft" - is not just shorthand, it's a sophomoric statement with commentary. If you don't know that, use words and phrases you understand.
  - icebraining 12y ago
    Microsoft seized them by court order, I don't see how was it without notice or how could they have done it illegally.
- tdicola 12y ago
  They've certainly lost trust from the thousands of folks they broke who weren't involved with the botnet at all.
  - shmerl 12y ago
    Never trust MS.
- mikelat 12y ago
  It's not like they had much of a reputation with the tech savvy crowd to begin with, with their frivolous patent litigation and business practices. The kind of crowd that uses a service like no-ip is the kind of crowd that likely isn't a big microsoft customer. The typical computer user will be ignorant to this and enterprise users don't care. The only way they'll really lose from this fiasco is if no-ip sues and wins in court.
dang 12y ago
Url changed from http://threatpost.com/all-seized-domains-returned-to-no-ip/107028 http://threatpost.com/all-seized-domains-returned-to-no-ip/1..., which points to this.
tonywebster 12y ago
The existence of the case has been unsealed, so here's the latest docket: http://ia902509.us.archive.org/20/items/gov.uscourts.nvd.101935/gov.uscourts.nvd.101935.docket.html http://ia902509.us.archive.org/20/items/gov.uscourts.nvd.101... Looks like there was a stipulation filed on July 1 to transfer the domains back to No-IP, although the actual document isn't accessible in PACER.
- jsmthrowaway 12y ago
  I found the TRO that pulled the trigger: http://www.scribd.com/doc/232961396/MSFT-Temporary-Restraining-Order http://www.scribd.com/doc/232961396/MSFT-Temporary-Restraini...
  - tonywebster 12y ago
    That was published by Microsoft before the case was unsealed, so that one has been known for awhile, nothing new. http://www.noticeoflawsuit.com/ http://www.noticeoflawsuit.com/
AndyKelley 12y ago
noip.me got seized as well? ".me is the Internet country code top-level domain (ccTLD) for Montenegro." - https://en.wikipedia.org/wiki/.me https://en.wikipedia.org/wiki/.me How did this happen? Since when did Montenegro fall under U.S. jurisdiction? I thought my personal domain (andrewkelley.me) was safe, but now I'm not so sure.
- matthewarkin 12y ago
  ICANN (the people in charge of DNS) is based in the US.
  - xorcist 12y ago
    ICANN is not "in charge of DNS". IANA, part of ICANN, manages the root zone. That's it. The top level domains are delegated to their respective organization. IANA could, in theory, re-delegate an entire top level domain, but everyone would notice and route around the problem.
- dsl 12y ago
  .me is operated by Afilias, a US corporation.
  - dublinben 12y ago
    Afilias is an Irish corporation, not a US one.
    - dsl 12y ago
      An Irish holding company. Actual technical registry operations are handled by Afilias USA, Inc. and subject to US law.
- us0r 12y ago
  "The contract was eventually awarded to doMEn, d.o.o., a Montenegrin joint venture (doing business as .Me Registry), whose partners include Afilias Limited, GoDaddy.com, Inc., and ME-net d.o.o." It's operated by two US based companies.

104 points by thefreeman 12y ago

z92 12y ago

Has Microsoft gained from this fiasco, or lost? Not sure.

Guvante 12y ago
I haven't seen heavy technical details on what the seizure involved, but if in theory they got a hold of some control domains they could have sent out kill commands to stop the malware from working or alternatively sent them to a static "do nothing" host.
- ntakasaki 12y ago
  According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour. http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/ http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-b... >However since hackers add new domain names every hour, 100+ new hostnames need to be blocked. I’ve sent a few updates to both services, but they haven’t yet responded and I guess we’ll need to wait until Monday when they get back to work.
  - dublinben 12y ago
    Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.
    - justsomedood 12y ago
      I'm sure they're using compromised hosts for the servers, which would change pretty often
    - nucleardog 12y ago
      How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
      - dublinben 12y ago
        Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
        nucleardog 12y ago
        It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
    - superuser2 12y ago
      Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?
Alupis 12y ago
Microsoft seized the domains in order to discover command-and-control servers of a few botnets. Now... whether or not Microsoft seizing another legitimate company's property without any notice is legal/ethical is another question (one that probably should get more attention).
- joe_the_user 12y ago
  What is the justification of this post being pretty severely downvoted? It's not intemperate or off-topic as far as I can tell. Go ahead and downvote me too for metacommenting but it seems like slaps being handed out so freely just degrades community by making people reluctant to comment.
  - deleted 12y ago
    [deleted]
  - wfjackson 12y ago
    Your parent poster did a :s/M$/Microsoft on that comment before you read it. Edit: They then replied to your post with "I was wondering the same thing", before reading my post and deleting that comment.
    - deleted 12y ago
      [deleted]
      - jabits 12y ago
        "M$" is a shorthand for "Microsoft" - is not just shorthand, it's a sophomoric statement with commentary. If you don't know that, use words and phrases you understand.
- icebraining 12y ago
  Microsoft seized them by court order, I don't see how was it without notice or how could they have done it illegally.
tdicola 12y ago
They've certainly lost trust from the thousands of folks they broke who weren't involved with the botnet at all.
- shmerl 12y ago
  Never trust MS.
mikelat 12y ago
It's not like they had much of a reputation with the tech savvy crowd to begin with, with their frivolous patent litigation and business practices. The kind of crowd that uses a service like no-ip is the kind of crowd that likely isn't a big microsoft customer. The typical computer user will be ignorant to this and enterprise users don't care. The only way they'll really lose from this fiasco is if no-ip sues and wins in court.

dang 12y ago

Url changed from http://threatpost.com/all-seized-domains-returned-to-no-ip/107028 http://threatpost.com/all-seized-domains-returned-to-no-ip/1..., which points to this.

tonywebster 12y ago

The existence of the case has been unsealed, so here's the latest docket: http://ia902509.us.archive.org/20/items/gov.uscourts.nvd.101935/gov.uscourts.nvd.101935.docket.html http://ia902509.us.archive.org/20/items/gov.uscourts.nvd.101... Looks like there was a stipulation filed on July 1 to transfer the domains back to No-IP, although the actual document isn't accessible in PACER.

jsmthrowaway 12y ago
I found the TRO that pulled the trigger: http://www.scribd.com/doc/232961396/MSFT-Temporary-Restraining-Order http://www.scribd.com/doc/232961396/MSFT-Temporary-Restraini...
- tonywebster 12y ago
  That was published by Microsoft before the case was unsealed, so that one has been known for awhile, nothing new. http://www.noticeoflawsuit.com/ http://www.noticeoflawsuit.com/

AndyKelley 12y ago

noip.me got seized as well? ".me is the Internet country code top-level domain (ccTLD) for Montenegro." - https://en.wikipedia.org/wiki/.me https://en.wikipedia.org/wiki/.me How did this happen? Since when did Montenegro fall under U.S. jurisdiction? I thought my personal domain (andrewkelley.me) was safe, but now I'm not so sure.

matthewarkin 12y ago
ICANN (the people in charge of DNS) is based in the US.
- xorcist 12y ago
  ICANN is not "in charge of DNS". IANA, part of ICANN, manages the root zone. That's it. The top level domains are delegated to their respective organization. IANA could, in theory, re-delegate an entire top level domain, but everyone would notice and route around the problem.
dsl 12y ago
.me is operated by Afilias, a US corporation.
- dublinben 12y ago
  Afilias is an Irish corporation, not a US one.
  - dsl 12y ago
    An Irish holding company. Actual technical registry operations are handled by Afilias USA, Inc. and subject to US law.
us0r 12y ago
"The contract was eventually awarded to doMEn, d.o.o., a Montenegrin joint venture (doing business as .Me Registry), whose partners include Afilias Limited, GoDaddy.com, Inc., and ME-net d.o.o." It's operated by two US based companies.