DNSChanger: when the internet's address book was swapped

The story

Every time you visit a website, your computer asks a DNS server to turn the name into a numeric address. DNSChanger was malware that changed which DNS server a computer asked.

It spread as a fake video player download. Once installed, it pointed the computer at servers run by an Estonian company called Rove Digital. Those servers answered most lookups correctly, so nothing seemed wrong. But they swapped the ads on web pages for their own and sent some searches and links to different sites. The malware also blocked access to antivirus updates. At its peak, it was estimated to have infected more than four million computers.

In November 2011, in Operation Ghost Click, US prosecutors charged seven people and the FBI seized the servers. That created a problem: turning them off would have cut infected computers off from the internet. A court allowed replacement servers to run in their place until July 2012, giving people time to clean up.

Why it mattered

DNSChanger showed how much a computer trusts the service that turns names into addresses. Whoever controls that service can quietly change what every website shows. The cleanup also showed how long infections linger: days before the replacement servers were switched off, at least 300,000 computers were estimated to be still infected.

The lesson today

DNS is easy to overlook because it works quietly. Whoever controls it controls where your computer actually goes. DNS settings on your computers and network equipment are worth protecting, and filtered DNS can block known bad sites before a connection is made.