Millions of dynamic DNS users suffer after Microsoft seizes No-IP...

[A Guy]

Millions of dynamic DNS users suffer after Microsoft seizes No-IP domains

Millions of legitimate servers that rely on dynamic domain name services from No-IP.com suffered outages on Monday after Microsoft seized 22 domain names it said were being abused in malware-related crimes against Windows users.

Microsoft enforced a federal court order making the company the domain IP resolver for the No-IP domains. Microsoft said the objective of the seizure was to identify and reroute traffic associated with two malware families that abused No-IP services. Almost immediately, end users, some of which were actively involved in Internet security, castigated the move as heavy handed, since there was no evidence No-IP officially sanctioned or actively facilitated the malware campaign, which went by the names Bladabindi (aka NJrat) and Jenxcus (aka NJw0rm).

"By becoming the DNS authority for those free dynamic DNS domains, Microsoft is now effectively in a position of complete control and is now able to dictate their configuration," Claudio Guarnieri, co-founder of Radically Open Security, wrote in an e-mail to Ars Technica. "Microsoft fundamentally swept away No-IP, which has seen parts of its own DNS infrastructure legally taken away."

Source

A Guy

 

[King Arthur]

An update to this piece of news:

Order restored to universe as Microsoft surrenders confiscated No-IP domains

Microsoft has surrendered the 23 domain names it confiscated from dynamic domain hosting service No-IP.com, a move that begins the process of restoring millions of connections that went dark as a result of the highly controversial legal action.

At the time this post was being prepared, No-IP had recovered 18 of the domains and was in the process of reacquiring the remaining five from Public Interest Registry, the registrar dealing Internet addresses ending in .org, No-IP spokeswoman Natalie Goguen told Ars. People who rely on No-IP subdomains that don't end in .org should already have service restored, as long as the domain name service (DNS) server they use has been updated to reflect Wednesday's transfer. Users who are still experiencing connectivity problems should try using DNS services from Google or OpenDNS, which have both updated their lookups to incorporate the transfers.

Source: Order restored to universe as Microsoft surrenders confiscated No-IP domains | Ars Technica

------

I am on the side of Microsoft (No-IP not taking advised security measures is an obvious red flag), but I wonder how effective Microsoft's actions were in all this. I sincerely hope MS's actions were worth the costs they incurred for everyone's benefit.

 

[Layback Bear]

What choice was their. No-IP couldn't be allowed to do business as usual. How could all this be going on and nobody at No-IP.com knew about it.

 

[Britton30]

As partial justification for the request, Microsoft lawyers argued No-IP didn't follow security best practices.

As we all know Lawyers don't lie unless their lips are moving.

 

[carwiz]

That is pretty heavy handed. I wonder how they got a federal judge to sign-off on that one? That would be like shutting down AT&T because a group of people were making obscene phone calls.

 

[King Arthur]

I only know about this chain of events so far as what I've read of it on ArsTechnica and Slashdot, but I am going to wager a guess that the focal point was No-IP allegedly not taking the appropriate measures that Microsoft and Cisco had advised them with.

When you advise someone that their assets are being abused and even advise them of the proper actions to take to address that and they keeps turning a blind eye or acts deaf, what options are left other than to say to them "your gig's up" and resort to drastic measures?

 

[z3r010]

The thing that gets me about this is who decided Microsoft should be the internet police and take control of other peoples domain/IP's?

 

[Bertison]

I only know about this chain of events so far as what I've read of it on ArsTechnica and Slashdot, but I am going to wager a guess that the focal point was No-IP allegedly not taking the appropriate measures that Microsoft and Cisco had advised them with.

When you advise someone that their assets are being abused and even advise them of the proper actions to take to address that and they keeps turning a blind eye or acts deaf, what options are left other than to say to them "your gig's up" and resort to drastic measures?

I think that is most likely to be true. NO-IP was obviously not giving the right customer service, by detecting these ratbags and stopping the service from being misused.

Having said that, Microsoft cannot carry out such heavy-handed tactics in Europe. At This Moment In Time...

 

[Britton30]

The thing that gets me about this is who decided Microsoft should be the internet police and take control of other peoples domain/IP's?

Exactly.

 

[Layback Bear]

In this case the courts gave permission to Microsoft.
How that all came about I really don't know. May be it's time for others to step up to the plate and help keep the internet a better place.
From my understanding Microsoft proved to the court that
No-IP with their methods were damaging Microsoft customers.
No-IP was probably damaging other companies customers but none stepped up to the plate to help their customers.

I do see the good and the bad in this action but I don't see another way of helping the the thousands or millions of the customers from No-IP lack of concern.
No-IP was nothing but a super highway for infections with some honest DNS thrown in to make it look legit.

Of course this is just my opinion.

 

[A Guy]

The thing is, Microsoft is /was often blamed for these infections. I think they decided they wouldn't be the scapegoat, and had the resources to make one major move a month. No one complains when they take down a spam network. They saw this as the same thing, they just took out a lot of innocents this time. Right or wrong, I bet NO_IP gpt the message. A Guy

 

[lehnerus2000]

If crimes were being committed, surely US Government agents should be responsible for "taking out" these services (e.g. FBI or similar)?

 

[King Arthur]

The thing is, Microsoft is /was often blamed for these infections. I think they decided they wouldn't be the scapegoat, and had the resources to make one major move a month. No one complains when they take down a spam network. They saw this as the same thing, they just took out a lot of innocents this time. Right or wrong, I bet NO_IP gpt the message. A Guy

The collateral damage here also wouldn't result in any permanent or serious damage since anything system-critical shouldn't be relying on something like No-IP anyway, and for anything that did this was a great wakeup call to those bad-mannered sysadmins.

Overall a beneficial chain of events I think, despite the collateral damage. Sometimes you just can't have your cake and eat it too, no matter which way you cut it.