Some Operation Ghost Click IP Addresses Back From The Dead

In advance of court proceedings, RIPE reallocates some IP address blocks that had been used by crime gang in DNSChanger malware scheme

If a legitimate business purchases one of the former DNSChanger IP addresses that RIPE unexpectedly reallocated earlier this month, it may find its IP traffic blacklisted in many places. If an unsavory operator gets one of those IP addresses, then it could gain control of some of the 200,000 to 300,000 machines still infected with the malware.
The move this month by regional Internet registry RIPE to reallocate the tainted IP addresses caught the
DNS Changer Working Group (DCWG)
and others in the industry by surprise. The DCWG -- an ad hoc group made up of members from Georgia Tech, Internet Systems Consortium, Mandiant, National Cyber-Forensics and Training Alliance, Neustar, Spamhaus, Team Cymru, Trend Micro, the University of Alabama at Birmingham, and other organizations -- helped run the temporary DNS servers that replaced the malicious Rove Digital ones used in the DNSChanger operation.
The FBI, via the Internet Systems Consortium (ISC), controlled those formerly malicious IP addresses from November 2011, after the takedown and arrest of the operators, until July 9, when
the FBI shut down the temporary DNS servers that were meant as a stopgap
until as many victims as possible had been alerted and remediated.
The FBIs Operation Ghost Click
last year dismantled the scheme and indicted six Estonians and one Russian
allegedly involved in infecting users and redirecting their computers to phony websites in a click-fraud scam. There were initially millions of infected machines, and the malware has been around for several years -- initially targeting home routers.
Paul Vixie, chairman and founder of the Internet Security Consortium (ISC), says RIPE should have held onto the IP addresses a minimum of 12 months before they reallocated them. They wont be much use to the recipients, anyway, because they remain widely blackholed, he says.
Theres another risk, as well, according to Barry Greene, a volunteer with the DNS Changer Working Group: Of course, there are still 200,000 to 300,000 computers still infected, and they could all be reacquired if someone says, Hey, give me those blocks of IP addresses and abuses them for nefarious purposes of their own, he says.
But we are monitoring that to see if any criminals do that, Greene says.
Greene says hes still unclear on just why RIPE decided to reallocate the IP addresses: The organization has a court proceeding scheduled for late November after requesting clarification of Dutch authorities orders to lock down registration of those IP addresses.
RIPE issued a statement on its decision last week: After receiving independent legal advice that the police order had no sufficient legal grounds to force the RIPE NCC to execute the order, the RIPE NCC unlocked the blocks of IPv4 address space on 10 January 2012, the statement said, in part. Two of the four address blocks included in the police order (93.188.160.0/21 and 85.255.112/20) were reallocated after the contractual relationship with the member holding the address space was terminated. The members account was closed and the space was deregistered ... The address space was quarantined for six weeks before being returned to the RIPE NCCs available pool of IPv4 address space. It was then randomly reallocated to a new resource holder according to normal allocation procedures.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Some Operation Ghost Click IP Addresses Back From The Dead