› ›

Microsoft's anti-malware crusade knackers '4 MILLION' No-IP users

ardentcrestardentcrest
edited July 2014 in Chit chat
Microsoft has won a court order to gain control of 23 No-IP domains owned by dynamic DNS (DDNS) provider Vitalwerks Internet Solutions. The US software giant claimed the domains were being used by malware developed in the Middle East and Africa.


http://www.theregister.co.uk/2014/07/01/microsoft_takes_over_noip_domains_to_block_malware_marketing/


Well there goes my sites...
Post edited by ardentcrest on

Comments

  • guesserguesser
    edited July 2014
    and mine. I know several people on here use free subdomains from no-ip.


    grrr.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • ewgfewgf
    edited July 2014
    Sorry, I'm not well up on Internet related matters (I just use it, without following the methodology and happenings behind my browser) but if I'm reading this right, does this mean that genuine sites by non-malware pushing people can/will be closed down? And by Microsoft (a private company) rather than by a government, or at least a company dedicated solely to the 'net (i.e. not Microsoft) and non-profit making (i.e again not Microsoft)?

    If so, assuming I've read it right, this is a terrible breach of peoples' rights, and yet another step closer to the 'closed Internet' that some people have been warning us about for years.
  • guesserguesser
    edited July 2014
    Microsoft have got a judge to order all no-ip's second level domain names that they use for dynamic DNS be transferred to them. Ostensibly because large numbers of third level domains (a small percentage of the actual users) are being used by botnets and no-ip aren't doing anything about it.

    no-ip claims that they do respond to complaints and cut off users who breach the terms. They also claim that Microsoft never contacted them and went straight for the legal option.

    Microsoft don't appear to have made any statement at all so no-one knows what's happening.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • guesserguesser
    edited July 2014
    Interestingly the microsoft internet safety nameservers do resolve my address if I query them directly, but going via any other DNS gets a servfail.

    This at least suggest that they intend to keep up their end of the deal and resolve the addresses not on their list, but that they have misconfigured something. :-x
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • pmsrpmsr
    edited July 2014
    I was affected by this. Early in the morning got a warning that one of the vpn tunnels of one of my customers was down. Sure enough, it was because one of the endpoints had ddns with noip.com and the dns cache had expired. Fortunately had been reading about it a few minutes before, and quickly connected the dots. Also use it for my own home router, but until now that has been working ok.

    /Pedro
  • AndyCAndyC
    edited July 2014
    guesser wrote: »
    no-ip claims that they do respond to complaints and cut off users who breach the terms. They also claim that Microsoft never contacted them and went straight for the legal option.

    no-ip have been claiming that for some time though and don't appear to have done anything about it. Microsoft taking control of the domains is far from ideal, but those companies providing the underlying infrastructure for the internet should be held accountable when they fail to react to abuse like this.
  • guesserguesser
    edited July 2014
    AndyC wrote: »
    no-ip have been claiming that for some time though and don't appear to have done anything about it. Microsoft taking control of the domains is far from ideal, but those companies providing the underlying infrastructure for the internet should be held accountable when they fail to react to abuse like this.

    Well according to them (yeah, I know) Microsoft (or anyone else) didn't send them list of domains and evidence of illegal activity, just lots of reports and hand wringing about the issue.
    If they weren't responding to actual specific complaints then that's a problem, but it's not a DNS provider's job to monitor the contents of every server running on every host for which they provide DNS resolution.
    In fact there may be no obvious way to tell that a host is a C&C node for a botnet unless you are monitoring the network activity coming and going from infected computers as microsoft, cisco etc do.
    This traffic is not travelling over networks controlled by Vitalwerks so how are they supposed to detect it?
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • SokurahSokurah
    edited July 2014
    pmsr wrote: »
    I was affected by this. Early in the morning got a warning that one of the vpn tunnels of one of my customers was down.

    Why would anyone use free domain services for professional use?

    Register a damn domain and do it the "right way" you cheap bastards.
    Website: Tardis Remakes / Mostly remakes of Arcade and ZX Spectrum games.
    My games for the Spectrum: Dingo, The Speccies, The Speccies 2, Vallation, SQIJ.
    Twitter: Sokurah
  • guesserguesser
    edited July 2014
    Sokurah wrote: »
    Why would anyone use free domain services for professional use?

    Register a damn domain and do it the "right way" you cheap bastards.

    Thank you for your enlightened and helpful input, please file it up your own arse.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • pmsrpmsr
    edited July 2014
    Sokurah wrote: »
    Why would anyone use free domain services for professional use?

    Register a damn domain and do it the "right way" you cheap bastards.

    ALL users, free and paid (me, and my customer, are part of the last group), were affected. Noip.com is the biggest, most supported dynamic dns provider. It is supported by, I would say, mostly all, if not all, routers and vpn concentrators that provide a dynamic dns service. And I don't follow you. How just registering a domain will help with dynamic dns? Are you really sure you know what you are talking about?

    /Pedro
  • guesserguesser
    edited July 2014
    I am so annoyed, mostly with Microsoft's silence on why their nameservers are failing for anything but direct queries, but partly with myself.

    I was thinking about how now I have a lot of stuff running on my server, and my current ISP provides a static IP (when I started using no-ip dynamic DNS I had a dynamic IP obviously...) I ought to get on and register a domain name and start migrating everything.

    As with many other things I have put this off and forgotten about it as other things have been more pressing. It's so frustrating.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • chevchev
    edited July 2014
    guesser wrote: »
    I am so annoyed, mostly with Microsoft's silence on why their nameservers are failing for anything but direct queries, but partly with myself.

    I was thinking about how now I have a lot of stuff running on my server, and my current ISP provides a static IP (when I started using no-ip dynamic DNS I had a dynamic IP obviously...) I ought to get on and register a domain name and start migrating everything.

    As with many other things I have put this off and forgotten about it as other things have been more pressing. It's so frustrating.

    If you have a static IP then I can recommend Joker.com. I bought my domain through a reseller and when they hiked their prices I found I could just go straight to the source so I stuck with Joker. I'm not sure, but they may also offer DDNS services.
    zx.itch.io
  • slenkarslenkar
    edited July 2014
    where do they get judges who can understand this stuff?
    Or do they use juries?

    The average layman would probably just decide in favor of microsoft cos they are considered the 'good guys'
  • ardentcrestardentcrest
    edited July 2014
    I'm sick of the US doing things like this. I live in IRELAND. We DO NOT Have US courts in IRELAND. We Do not live by US LAW in IERLAND.

    Block No IP in the US if it came from a US court.

    If you want to block No IP in Ireland.... GO TO AN IRISH COURT..........
  • guesserguesser
    edited July 2014
    ardentcrest wrote: »
    I'm sick of the US doing things like this. I live in IRELAND.

    You were using a US controlled domain though. It's annoying, but that's how it is. If you don't want a court outside your country to hijack your DNS then you should be using a .ie address...

    I note that Microsoft claim to have fixed the technical issue - however their nameserver are still returning no answers to requests made by another DNS server. (i.e. it only works if you directly query their nameserver)
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • guesserguesser
    edited July 2014
    Hmm, looking at the list of subdomains does throw into question how sophisticated their "sophisticated filters" really are.
    Or they weren't scanning for hosts with windows or windowsupdate in the string heh. I suppose a filter is only as good as the rules you give it.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • ardentcrestardentcrest
    edited July 2014
    is it me or is no ip down

    www.noip.com
  • guesserguesser
    edited July 2014
    apparently they're being hit by a ddos.

    Presumably by a bunch of idiots who think it's their fault nothing will resolve. The comments on their blog were full of them, demanding no-ip magically turn their domain back on :roll:
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • chevchev
    edited July 2014
    guesser wrote: »
    apparently they're being hit by a ddos.

    Presumably by a bunch of idiots who think it's their fault nothing will resolve. The comments on their blog were full of them, demanding no-ip magically turn their domain back on :roll:

    I prefer to call them criminals. DDoS attacks usually require a botnet.
    zx.itch.io
  • guesserguesser
    edited July 2014
    aowen wrote: »
    I prefer to call them criminals. DDoS attacks usually require a botnet.

    Well any deliberate DDoS is criminal. The point is that some criminals are rather smart and make lots of money off "cybercrime".

    If it's a retaliatory attack against the wrong party then it must be perpetrated by idiots.
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • chevchev
    edited July 2014
    guesser wrote: »
    Well any deliberate DDoS is criminal. The point is that some criminals are rather smart and make lots of money off "cybercrime".

    If it's a retaliatory attack against the wrong party then it must be perpetrated by idiots.

    Ok, I'll compromise. How about the criminally stupid?
    zx.itch.io
  • guesserguesser
    edited July 2014
    Well the good news is that control of the domains appears to have been returned to vitalwerks as they are now pointing back at the no-ip nameservers.

    Everything should start returning as soon as yor DNS server cache expires (or you flush it manually if it's one you control)
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • ardentcrestardentcrest
    edited July 2014
    No-IP regains control of some domains seized by Microsoft.


    http://www.pcworld.com/article/2450620/noip-regains-control-of-some-domains-wrested-by-microsoft.html

    Vitalwerks, which runs No-IP, said it now has 18 of 23 domains commandeered by Microsoft on Monday using a restraining order granted by the state?s federal court.
  • guesserguesser
    edited July 2014
    no-ip.org was returned at least 11 hours ago, so presumably everything is back 100%. (and as usual the tech blogs are all just repeating what each other post instead of confirming it themselves which takes a matter of seconds at a command line)
    My rubbish website including the redrawn Amstrad schematics and the Sinclair Wiki.
  • TimmyTimmy
    edited July 2014
    Well it seems that there's been a settlement between no-ip and microsoft, so you bet someone has done something wrong there. (can't find a link)

    There seems to be no deals with the affected sites yet, so expect this story to continue...
    How to write a simple BASIC* horizontal scrolling game (Tutorial) - How to write a simple C+asm horizontal scrolling game (Tutorial, z88dk)
    Games List 2016 - Games List 2015 - Games List 2014
Sign In or Register to comment.