Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Australian websites caught up in DNS Changer case

Trend Micro advises people to check with FBI if their computer has been affected

Thousands of computers in Australia may have been affected by the largest botnet, dubbed domain name system (DNS) Changer, according to evidence from Trend Micro.

A group in Estonia was investigated by the Federal Bureau of Investigation (FBI) and found to be responsible for the malware which hijacked users' clicks. It then redirected to hacker-created sites that resembled the real domains.

Trend Micro Australia software architecture director, Jon Oliver, said the company had been tracking DNS Changer since 2006 when it started identifying strange behaviour in command and control servers doing “DNS tricks.”

“The group was changing part of the internet so the ads which appeared on some Australian websites could show illegitimate ads which were not paid for by anyone,” he said. “The person who had paid for ads on those sites lost their impressions.”

The security vendor discovered that a company called Rove Digital, which had made itself out to be a legitimate business, was behind the attacks.

“Our part was establishing this because in cyber crime it’s very difficult to establish who is committing the offence,” he said.

“We started with suspicions and then collected evidence that this advertising crime was definitely occurring. A multiple of other crimes were also occurring such as hijacking search results, phishing and fake anti virus.”

Trend Micro collected all this evidence over six years and handed it to the FBI.

Oliver said part of the reason the takedown took so long was because establishing all the elements of the crime proved difficult due to the cyber criminals operating in more than one country.

“Equipment was seized in places like Chicago yet the arrests took place in Estonia.”

According to Trend Micro, the cyber criminals got away with at least $US14 million before members were arrested on 9 November, 2011.

Oliver advised Australians who had concerns about their computer to enter their IP address on the FBI website as the Bureau would be able to tell them if they had been infected by DNS Changer.

He added that the lesson for companies was to use multi layers of defence, and educate users about cyber security.

“When users are seeing suspicious activity they should be reporting it to their IT manager who is taking extra vigilance,” he said. “The down time and cost that’s occurring for many companies is huge so they need to take security very seriously.”

Got a security tip-off? Contact Hamish Barwick at hamish_barwick at idg.com.au

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow Computerworld Australia on Twitter: @ComputerworldAU

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: FBI, Federal Bureau of Investigation, Trend Micro
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: DNS Changer, fbi, information security, trend micro
Latest Blog Posts
Whitepapers
  • Cost Effective Security and Compliance with Oracle Database 11g Release 2
    Information ranging from trade secrets to financial data to privacy related information has become the target of sophisticated attacks from both sides of the firewall. Built upon 30 years of security experience, the Oracle database provides defense-in-depth security controls that enable organizations to transparently protect data. By leveraging these controls, organizations can safeguard data, ensure regulatory compliance, and achieve business goals such as consolidation, globalization, right sourcing and cloud computing while still maintaining scalability, performance and availability. Read this whitepaper.
    Learn more »
  • Blurring boundaries: The disappearing gap between work and home life
    Call it multi-tasking, life-splicing or bleisure but increasingly, fuelled by advances in technology, employees are blurring the boundaries between home and work. ‘Generation Standby’ employees, never truly ‘switched off’ and always ready to be called upon, are now enjoying, and expecting, greater levels of flexibility and mobility than ever before. Read on.
    Learn more »
  • Justifying Business Intelligence Applications
    This white paper explores the decision criteria used in a build vs. buy scenario when considering the Oracle BI Applications. The major benefits of the BI Applications will be discussed in the framework of an overall buy vs. build argument.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments