Showing posts with label dns. Show all posts
Showing posts with label dns. Show all posts

Sunday, July 8, 2012

Hundreds of thousands may lose web access July 9 due to virus



fbi, internet, malware, spyware, dns, dnschanger, viruses, warnings, isc, dcwg, hundre
July 9 is the day thousands of PCs (and Macs) infected with DNSChanger will lose their ability to surf the web. Although the virus was introduced in 2007, according to the DCWG's data, as many as 500,000 computers may still be infected. This is a friendly reminder to make certain your computers are malware-free and that their DNS settings are nominal.

In 2011, the FBI busted the unscrupulous band of individuals responsible for DNSChanger, shutting down their Eastern European servers -- a move which actually knocked millions of infected users off the web. Although those servers run by the criminals were used to feed infected users profitable ads, phishing attempts and malware, they also provided victims with a working DNS service -- servers which allow human-friendly hostnames to point to Internet locations that computers understand (IP address numbers). 

Victims were left with computers configured to use DNS servers which no longer existed. As a result, nearly 4 million people were left without Internet access.

As a courtesy, FBI technorati organized an effort to temporarily provide DNS service for DNSChanger victims. After a period of time though, the FBI handed off this responsibility to the Internet Systems Consortium, a non-profit organization who has managed to keep the DNS flowing to infected users. However, this act of kindness will end on Monday.


How do I find out if I'm infected with DNSChanger?
Google and Facebook have been warning infected users. You can also manually check using this tool.

What should I do if I'm infected?

Visit DCWG for instructions and a list of utilities capable of removing DNSChanger from your computer. If none of these tools seem to work, your router's settings may have been changed by the virus (it does do that, believe it or not). You'll need to enter your router's web configuration (instructions vary) and change its DNS settings.

Virus scanners have been able to detect and prevent DNSChanger infections for some time now. Protect yourself!

Friday, December 30, 2011

GoDaddy accused of interfering with domain transfers


domain, piracy, sopa, dns, godaddy, domain transfer
GoDaddy, the domain management and web hosting company suffered a rather bleak Christmas weekend after it became public news that the company was supporting SOPA. The company lost more than 37,000 domains in just a couple of days and that number has gone up further since then.

It all started when Republican congressman Lamar Smith released a full list of those supporting the Stop Online Piracy Act (SOPA) last week. While media firms such as Time Warner, CBS, NBC and the like are no surprise, GoDaddy's addition to the list was, and consequently a huge public backlash ensued.

If that wasn't bad enough, GoDaddy is now being accused of attempting to deliberately delay the transfer process of domains being moved from its service. Namecheap, who saw an opportunity in clearly stating they were anti-SOPA whilst offering discounts to those wanting to move their domains, has reported that GoDaddy is returning incomplete WhoIs information to them during the transfer process.They also made it clear they would manually transfer domains if they had to, in light of GoDaddy's actions.

As many customers have recently complained of transfer issues, we suspect that this competitor is thwarting efforts to transfer domains away from them. Specifically, GoDaddy appears to be returning incomplete WHOIS information to Namecheap, delaying the transfer process. This practice is against ICANN rules. We at Namecheap believe that this action speaks volumes about the impact that informed customers are having on GoDaddy’s business. It’s a shame that GoDaddy feels they have to block their (former) customers from voting with their dollars. We can only guess that at GoDaddy, desperate times call for desperate measures.
Rich Merdinger, Sr. Director of Product Development at GoDaddy responded to the blog post by saying the delay was a normal procedure designed to protect its clients from fraudulent activity.

Namecheap posted their accusations in a blog, but to the best our of knowledge, has yet to contact GoDaddy directly, which would be common practice for situations like this. Normally, the fellow registrar would make a request for us to remove the normal rate limiting block which is a standard practice used by GoDaddy, and many other registrars, to rate limit Whois queries to combat WhoIs abuse.

Because some registrars (and other data gathering, analyzing and reporting entities) have legitimate need for heavy port 43 access, we routinely grant requests for expanded access per an SOP we’ve had in place for many years. Should we make contact with Namecheap, and learn they need similar access, we would treat that request similarly.

As a side note, we have seen some nefarious activity this weekend which came from non-registrar sources. But, that is not unusual for a holiday weekend, nor would it cause legitimate requests to be rejected. Nevertheless, we have now proactively removed the rate limit for Namecheap, as a courtesy, but it is important to point out, there still may be back-end IP addresses affiliated with Namecheap of which we are unaware. For complete resolution, we should be talking to each other — an effort we are initiating since they have not done so themselves.
Namecheap responded with another statement saying they had tried to reach out and resolve the issue.

I understand that a number of publications have received a note from GoDaddy’s PR team saying that “to the best of [their] knowledge,” we hadn’t reached out. This is quite untrue as our upstream technicians had made attempts to reach out directly.

That said, it was known for almost a full 24 hours that we were blocked from having the transfers go through. In efforts to be fully transparent about the delays which were greatly upsetting to our customers, we posted this after reaching out to GoDaddy as we had no response.

We updated this post long before any publication came out with GoDaddy’s PR response to say that GoDaddy did confirm that they unblocked us. We wouldn’t have known that if there was no communication.

I can now confidently say that we’ve been able to process thousands of transfers since we were unblocked and should be up to speed by later tonight. We truly appreciate everyone’s patience and apologize for the delays that impacted our customers.
Meanwhile, domain registrar Hover contacted Neowin to say it hasn't experienced any issues with domain transfers, pointing at the possibility of eNom experiencing technical issues as a potential cause of the problems.

This would be a serious violation of [GoDaddy's] ICANN accreditation if it were the case. Namecheap is an eNom reseller and it may be possible that eNom is experiencing more general issues. I wonder if this is a more localized issue than Namecheaps might be aware of. We've seen a wild and consistent increase in transfer-in activity in the last week and its not showing any signs of slowing up. I'd be surprised if GoDaddy was taking punitive action, and of course, it almost goes without saying that not a day goes by when something in this business doesn't surprise me.
Despite at first suggesting their position would make no impact on its client portfolio, GoDaddy has since retracted its support of SOPA after bearing witness to a huge client exodus. Big household names such as Wikipedia confirming they are to move all their domains away from GoDaddy is not going to help the embattled firm rebuild its now tattered reputation as more people vote with their wallets and follow suit.