[Article first published as DNS Changer Malware and the FBI's July 9th Deadline: What It Is and What You Should Know on Blogcritics.]
Depending on how close you are to your local nerd, you should have already heard about a computer virus that is claimed to eventually cause thousands of people to lose their internet access in just a few days on July 9th. Some folks don't even know it's coming, some have waved it off as a hoax, and some have even gone so far as to claim immunity because of course, nothing could penetrate their primitive anti-virus shields, regardless of everything I've been trying to tell them. At any rate, it's happening. So what exactly's going on? The culprit behind this scheduled havoc is a particular class of malware known as DNS Changer. Before I get into what exactly it's doing, I should give you a short primer DNS and what it does - because after all, like it's named, DNS Changer changes DNS.
"Phone Numbers for the Web" - A Quick DNS Primer
Think about phone numbers for a second. Suppose my phone number is (123) 456-7890. If someone has that phone number written down, and just that phone number, they have no idea who exactly they're calling if they punch it into a phone. The information they have to contact me over the phone is incomplete. Now if they have two pieces of information - the phone number and my name to go with it, then that makes far more sense. Now they know that I'm at the other end of (123) 456-7890.
DNS is exactly the same thing. Internet websites have what's called an IP address (think phone number for a website). Now let's make an example. I'm going to give you an IP address, and you tell me what that address goes to. Ready? OK, here it is: 22.214.171.124. Complete gibberish to you? I'll tell you what. Take that number and put it into your web browser where you put in what website you want to go to, and tell me if it doesn't take you right to Google. DNS is what allows your browser to cleanly translate domain names to IP addresses - in this case it matches up 126.96.36.199 to "http://www.google.com." Just like a phone number. You don't get out your cell every time you want to call me and dial out (123) 456-7890. You go to my name. Your address book, as it turns out, is a mini list of DNS entries, matching numbers to names.
That was just a basic primer, but it gets far more complex than that when it comes to the Internet. There's not just one DNS server, but many that communicate to allow you to browse the web. You browse the web primarily using the DNS servers that belong to your Internet Service Provider (Comcast, Verizon, Roadrunner, or whoever you pay your bills to).
What Does DNS Changer Do?
So now that you have a better idea of what DNS is, let's look at what DNS Changer does. In the end it can do the same thing that email phishing scams can do in the sense that it can lead you to fake and fraudulent websites to try to steer you in the wrong direction. This works a little bit differently though - instead of sending you fake links hoping that you'll click them without paying attention, DNS Changer literally changes your DNS settings, giving the intruder the ability to change where you go and leave your computer wide open to a number of cyber attacks. The image to your right is a great concise diagram from the official FBI website that shows how it works.
The FBI has been able to identify networks of these rogue DNS servers that can potentially do you harm through what was known as Operation Ghost Click, and have taken a number of steps not only to disable them, but to help internet users until they do. They've been working with ISPs and providing known clean DNS servers so that affected users can redirect to them to browse safely. On July 9th, support for these temporary clean DNS servers ends, so everyone has to make sure that they're up to snuff.
What Can I Do?
But fear not friends. There is something that can be done. First and foremost, go to this website to check if your current DNS settings are legit and not hijacked: http://dns-ok.us/. If the image comes back with a nice green background like at the top of this post, then your DNS settings are in good working order. If it comes back red, that means your DNS settings have been jacked to hit rogue DNS servers and you have some fixes to make. There will be a link too that will point you in the right direction.
If it comes back red, there are steps you can take. The FBI as well as the DNS Changer Working Group (DCWG) have sites set up to guide you through the process that you can get to at the bottom of this post. The most important thing to remember is that if your check does come back red, as I mentioned that means that you could be vulnerable to additional malware and viruses.
Check in with your local nerd if you have any issues or questions. I've also set up a temporary email address you can send your questions to through July 9th, at email@example.com.
DNS Changer Checker: http://dns-ok.us
Official FBI DNS Changeer website:http://www.fbi.gov/news/stories/2011/november/malware_110911
DCWG DNS Changer website: http://www.dcwg.org/