Firstly, what is a DNS ?

* DNS Trojan &

Optimisation

* Phone Book analogy

* We talk to people, but Phones work on Numbers . . .

* We use a Phone Book to translate a person’s name to get the number to dial

* Web uses named URLs, but Internet works on Numbers .

* We use a DNS (Domain Name Server) to translatea URL name into a numeric Web

address.

Domain

Name

Server

Operation

Cmd Ipconfig Output

DNSChanger

Trojan

Domain

Name

Server

Troja

n Operatio

n

Rogue DNS

Rogue Server

* Implications

* Scam Emails – don’t click on embedded link . .

* Always type in Bank URLs (or Favourites/Bookmarks)

* So, key in bank URL (anz.com.au) to ensure OK

* BUT - Rogue DNS gives address of Rogue “ANZ” server

* Can then easily capture ID and PSW, then on-forward to real bank acct . .

* We are None the wiser . . . . till zero balance . . .

* FBI Reactions

* Once discovered - A-V vendors updated, warned people & provided check tools (widely promoted in other countries.. eg

AU )

* Used DNS Registration to “Hijack the Hijackers”*ie. Capture expanding rogue DNS IP

addresses and re-route to a valid DNS

* Needs considerable computing resources – so warning bypass to be shut down on Monday 9July . . .

DNS Trojan

Checking

DNS Changer Checking /

Removal

* DNS Usage

* Every URL / link needs to be translated . . . . .

* Thus we may access a DNS many times / session

* While DNS is usually provided by our ISP, thereare many others available . . . . .

* Question is - are we using the BEST one ? ?

* How can we test ? Process is “DNS Optimisation”

DNS Optimisation, using

NameBench

* Demo here

DNS Optimisation - My Results

* DNS Summary* DNS-Changer Trojan seems to be real threat !

* Easy to check and remove – before 9-July . . .

* DNS maybe used many of times for EACH page

* Google NameBench tool available ---- free

* 30% improvement available for me . . . . .

* Overall WEB performance seems improved !

* Try it yourself . . . . .