Carl Malamud sez, "Paul Vixie tells a real-life action adventure about the DNS Changer and Conficker plagues that are still active on the Internet and how he ended up running a center for disease control in addition to his day job. His day job, in case you're not familiar with isc.org, consists of helping keep the DNS going and as a sideline hosting a lot of important software and services like Mozilla, the Internet Archive, and many others (and a few lightweight low-volume clients like public.resource.org)."
Since the original court order that authorized ISC to install and operate these replacement DNS servers was due to expire on March 9 2012, a new DNS Changer Working Group (DCWG) was formed to handle victim notification and remediation. We had roughly four months to identify and notify half million or so DNS Changer victims, and to help these victims clean up their infected computers. Many victims would have to reinstall Windows on their computers — which at first was the only sure cure for this particular infection. On top of that, many of the victims have had their DSL or Cable modems ("home routers") reconfigured by the DNS Changer malware, so that they were using ISC's replacement DNS servers even if none of their computers are still infected and even if none of their computers were running Windows. Most Internet users do not have the skills necessary to check and repair the configuration of their home routers, and most Windows users are also unwilling to reinstall Windows. So, even when we could identify and notify a victim, we had a hard time "closing the deal".
We didn't make it. When March 9 2012 loomed, we still had hundreds of thousands of victims dependent on ISC's replacement DNS servers. Therefore the FBI asked the judge for an extension and we were given four more months. No fooling around this time, there won't be another extension, it's now or never, put up or shut up, etc. Noting that no private company or individual can legally operate this replacement DNS service on the open Internet unless they have a judge's permission to do so, many ISP's are now starting up replacement DNS servers inside their own networks, accessible only by their own customers, in order to control the risks they would otherwise face on July 9 2012 when the second and final court order is due to expire. But that kind of risk management isn't the same as cleaning up the problem. I don't think we want to "kick this can down the road". If an ISP wants to run a replacement DNS server for the purpose of forcibly breaking these computers, in small batches, to get their owners to call in and ask for help, that's one thing. But if it's just going to be a new permanent service that the ISP offers to these customers, count me as "opposed."
We as a digital society are much better at strategies for coping than we are at strategies for remediation.
(Thanks, Carl!)
