{"id":14974,"date":"2014-07-02T18:24:15","date_gmt":"2014-07-02T18:24:15","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=2178"},"modified":"2021-08-06T07:09:17","modified_gmt":"2021-08-06T11:09:17","slug":"gone-fubar-microsoft-nukes-no-ip-gets-fallout","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/gone-fubar-microsoft-nukes-no-ip-gets-fallout\/14974\/","title":{"rendered":"Gone fubar: Microsoft nukes No-IP, gets fallout"},"content":{"rendered":"

Microsoft has dealt a heavy blow to No-IP.com \u2013 a dynamic DNS provider for paid and free services, email, network monitoring and SSL certificates, that in Microsoft\u2019s view is a haven of malice. Microsoft obtained the court order allowing it to seize 22 domains it said were being abused in malware-related crimes against Windows users<\/a>. The problem is that due to Microsoft\u2019s activities, all users of No-IP \u2013 almost 2 million \u2013 suffered outages. This time free service apparently comes with an uncozy neighbourhood attached \u2013 instead of a price tag.<\/p>\n

\n<\/p>

\u00a0<\/p>\n

Microsoft is on a \u201csecurity crusade\u201d for quite some time already, and is doing great job at busting botnets and other massive threats. It is Microsoft that effectively annihilated Rustock in 2011, for instance, and it is going after Zeus family for years, smashing its latest one \u2013 GameOver \u2013 earlier this year (Microsoft\u2019s own report is dated<\/a> June 2nd).<\/p>\n

The situation with No-IP.com appeared to be yet another strike against cybercrime from Microsoft, and a heavy (-handed) one: citing the necessity to break down malware campaigns which went by the names Bladabindi (aka NJrat) and Jenxcus (aka NJw0rm), Microsoft enforced a federal court order making the company the domain IP resolver for the No-IP domains, effectively overtaking them.<\/p>\n

In a nutshell, it nuked No-IP fubar<\/em>, adding up also a wrecking ball of a civil case against No-IP owners <\/a>Vitalwerks Internet Solutions, LLC <\/a>\u201cfor their roles in creating, controlling, and assisting in infecting millions of computers with malicious software\u2014harming Microsoft, its customers and the public at large.\u201d<\/em><\/p>\n

It\u2019s necessary to say that the aforementioned malware has been used by multiple cybercriminal and activist groups to target users, including the notorious Syrian Electronic Army. A multitude of earlier reports pointed out No-IP domain abuse, but apparently No-IP did little about it. So Microsoft moved in hard.<\/p>\n

The takedown seems to have other beneficial consequences: It looks like many other APT operations have been disrupted, which used NO-IP for their C&C infrastructure. These include (and not limited to): Flame\/Miniflame, Turla\/Snake\/Uroburos, including Epic, Cycldek, etc.<\/p>\n

\u201cBased on our statistics, the shutdown has affected in some form at least 25% of the APT groups we are tracking. Some of these hosts that were previously used in large and sophisticated cyberespionage operations are now pointing to what appears to be a Microsoft sinkhole, at 204.95.99.59\u201d, <\/em>blogged Costin Raiu, Kaspersky Lab Expert, at Securelist.<\/a><\/p>\n

Unfortunately, this \u201cnuking\u201d had exceeding collateral damage: targeting 20 thousands No-IP malicious hosts, Microsoft knocked out as many as 4 million legitimate web-sites, affecting over 1.8 million No-IP customers, paying ones included.<\/p>\n

For those of our readers who play videogames, the abbreviation AOE must be quite familiar. For those who don\u2019t, this stands for Area Of Effect, and usually refers to explosive weapons or spells that damage everything at the targeted areas: a mage character casts some \u201cArcane Explosion\u201d and a bunch of petty monsters melt to the delight of the witnesses. Usually the caster is unaffected, however, in more hardcore games such \u201cKa-Boom!\u201d would knock down the caster character himself and his friends, if they\u2019re caught up in area of effect. And if it is a multiplayer game, the caster will hear a lot about his IQ, skills, and uncanny accuracy.\"800-2\"<\/a><\/p>\n

\u00a0<\/p>\n

Something like that happens now: for some unapparent reason<\/em> legitimate users of No-IP.com were caught in the AOE of Microsoft\u2019s nuking and did not exactly enjoy the consequences. And now the company faces a heavy fallout, thick with vitriol<\/a>: not only did it make lights off for a bagillion of legitimate users, including the paying ones, so far it even failed to restore the services. At least Microsoft did acknowledged \u201ca technical error\u201d<\/a> and essentially apologized for the inconvenience.<\/p>\n

No-IP currently claims to be under a DDoS-attack<\/a>.<\/p>\n

Summing up, there is a problem with free dynamic DNS services: cybercriminals just love them. Easy and free to register, easy to update hostnames to control malware implants, not too easy to identify the user positively.<\/p>\n

For legitimate entities short on budget such services are attractive either. But, just as said above, services with zero on a price tag are prone to have some other encumbrances,<\/em> such as\u00a0\u00a0 a malware spawning pool or APT attackers sitting next hostname. And this story shows just how unreliable such services may appear \u2013 due to their owners negligence (which shows up quite often) or legal and technical troubles, like it is this time.<\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft hit hard at No-IP.com, a dynamic DNS service which was in active use by cybercriminals. However, the “collateral damage” toll appeared to be a little too high.<\/p>\n","protected":false},"author":209,"featured_media":15442,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1999,3052],"tags":[93,36,38,2126,113],"class_list":{"0":"post-14974","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-smb","9":"tag-cybercriminals","10":"tag-malware-2","11":"tag-microsoft","12":"tag-no-ip","13":"tag-windows"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/gone-fubar-microsoft-nukes-no-ip-gets-fallout\/14974\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/gone-fubar-microsoft-nukes-no-ip-gets-fallout\/14974\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/gone-fubar-microsoft-nukes-no-ip-gets-fallout\/14974\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/cybercriminals\/","name":"cybercriminals"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/14974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/209"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=14974"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/14974\/revisions"}],"predecessor-version":[{"id":41071,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/14974\/revisions\/41071"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/15442"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=14974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=14974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=14974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}