Thread: FBI May Shut Down Your Internet Access March 8th

Tuesday, February 14, 2012
FBI May Shut Down Your Internet Access March 8th
Dees Illustration
Activist Post

This March 8th, the FBI is planning to unplug DNS servers it set up to help eliminate malware from over half of Fortune 500 companies and government agencies still infected in early 2012.

The change could potentially leave a great number of Internet users without access to the Web.

InfoWorld reports:

...the feds replaced the criminals' servers with clean ones that would push along traffic to its intended destination. Without the surrogate servers in place, infected PCs would have continued trying to send requests to aim at the now-unplugged rogue servers, resulting in DNS errors.

The malware, called DNSChanger Trojan, is said to illegally redirect traffic and prevent users from accessing the updates necessary to remove it. Without access to these critical patches, these large companies, government agencies, and home users are said to be more susceptible to hackers.

This prompted InfoWorld to wonder:

This fact does raise the question of why so many Fortune 500 companies and government agencies have failed to notice they have a problem, as they presumably have IT security professionals on staff who should be monitoring such incidents.


Those computers still infected with the Trojan will not be able to access the Internet after the FBI shuts down their temporary servers.

The feds received a court order in November, 2011 to replace the "rogue" servers with surrogate servers to operate "just long enough for companies and home users to remove DNSChanger malware from their machines."

Rod Rasmussen, president of Internet security company Internet ID, told Krebs on Security that there are still millions of PCs infected with DNSChanger. “At this rate, a lot of users are going to see their Internet break on March 8.”

A working group advising the FBI is said to be considering requesting an extension of the court order to give more time to users of infected machines to remove the malware.

Although this may indeed be a very real problem that Internet users must be vigilant to protect themselves from, depending on the government to provide servers when their own agencies are infected doesn't seem like a trustworthy solution. Additionally, a previous private-government working group put together in 2009 to combat the Conficker Worm has accomplished very little as 3 million computers are still said to be infected.

These viruses are called Trojans because they are disguised as something friendly, enter computers, and then install malicious software. Someone with a healthy distrust of the government may see the FBI's warning that millions will be cut off from the Internet as a Trojan Horse itself so that they may retain control over the new servers.

After all, if the FBI is controlling the "legitimate" servers, wouldn't they have access to all the traffic information of individual users and large corporations?

To ensure your computer is not infected please follow the instructions here. And follow Krebs on Security for news updates pertaining to this story.

To read other articles by Activist Post click here.

Please help us combat censorship: vote for this story on Reddit -- FBI Receives Court Order to Impose Targeted Internet Takeover on March 8th : conspiracy

Very misleading article. The FBI isn't shutting down your internet, they just aren't covering your butt anymore if you have the trojan. If you don't have internet simple fix is a clean wipe and reinstall. If any business or corporation doesn't have the brains to manage a migration of that sort then tough crap, they don't deserve to remain in business.

Will the FBI be shutting down the Internet March 8th?

Posted: 8:26 AM
Last Updated: 2 hours and 49 minutes ago
By: Ken Colburn, from datadoctors.com

What can you tell me about the FBI shutting off the Internet for thousands of users on March 8th?

The sometimes salacious 'kill switch' headlines about this story can easily give readers the wrong impression if they don't dig a little deeper into the details.

The FBI actually stepped in to ensure lots of folks didn't suddenly lose their ability to surf the web last year and those safety measures are set to expire on March 8th.

Last year, a group that had infected over 4 million computers worldwide (with an estimated half a million in the US) with what is called the DNSChanger Trojan was brought to justice.

The primary impact of this infection is that it caused web surfers to be sent to fraudulent websites by changing what is called the DNS settings on compromised computers.

The Domain Name System (DNS) is the backbone of the Internet's address scheme and DNS servers are special computers around the world that act as Internet traffic cops providing directions to websites that you wish to visit.

For instance, when you type Computer Repair by Data Doctors | Data Recovery by Data Doctors | Computer Repair & Data Recovery Experts in your web browser, your computer sends the request to the DNS server usually associated with your Internet service provider which translates your human friendly text request into the actual numeric address for that website (called the IP address).

If your computer was infected with the DNSChanger Trojan, you are being sent to a 'rogue traffic cop' that would send you into a virtual dark alley to be mugged. It also made sure that you couldn't get to security sites that had tools to help you clean up your computer.

When the FBI pinched this group, if they had shut down the rogue DNS servers, everyone that was infected would have instantly been cut off from the Internet so the FBI chose a different strategy.

They decided to get a court order allowing them to replace the rogue DNS servers with legitimate stand-ins so that all the infected computers wouldn't get cut off without warning giving them time to get the word out.

The court order runs out on March 8th, so anyone still infected with the DNSChanger Trojan will no longer be able to access the Internet because the temporary DNS servers won't be online anymore.

So you can see that the characterization of the FBI using a kill switch to cut our citizens off from the Internet is pretty inaccurate.

If everyone that's infected by this Trojan cleans it up before March 8th, no one will have a problem, but the infection is so widespread that it isn't likely to happen.

Both Windows and MacOS users are at risk for this infection because it exploits your browser, not your operating system.

If you are somewhat technical, you can do a self-check of your computer to make sure you're not infected by comparing your computer's DNS setting to the list of rogue DNS servers:

85.255.112.0 through 85.255.127.255
67.210.0.0 through 67.210.15.255
93.188.160.0 through 93.188.167.255
77.67.83.0 through 77.67.83.255
213.109.64.0 through 213.109.79.255
64.28.176.0 through 64.28.191.25

The FBI has published a pretty decent guide to performing the self-check at: http://goo.gl/raqfL but if you aren't comfortable doing the check yourself, make sure you consult a tech savvy friend or professional to avoid getting cut off on March 8th.

If you are infected by the DNSChanger Trojan, the FBI reminds us that this malware also disables security updates which could have further exposed you to other malware. Be sure you have a thorough cleanup performed and you get caught up on all the missing updates if you find your computer has been compromised as detection and removal is just the beginning of the process.

Will the FBI be shutting down the Internet March 8th?