Fatal System Error: The Hunt for the New Crime Lords Who Are Bringing Down the Internet

by Joseph Menn

After examining the computers operating the infectious sites, the forensics team finally worked out what made them so effective. For most visitors, including the sleuths, the sites appeared normal and harmless. But Bra1n had a friend in St. Petersburg who could hack into domain name servers and “poison” them, sending surfers seeking one site to a different one instead. If they agreed to pick Nike.com, for example, most people typing in that address would have gone to any of a large number of domain name servers and then to the right place. But if they happened to stumble on one of the poisoned servers, which were altered for just a half hour at a time, they would have been sent to highconvert.com or installme.info. Within ten seconds, the machines behind those websites would realize that the visitors were approved targets, check to see if they were running Internet Explorer as a Web browser, and if so use an exploit to install Trojan programs that would give control of the computers to Bra1n. Then they would dispatch the users to the real Nike.com. Few consumers complained about a ten-second detour. If they did, and thought to check their browser history for where they had been, technical support people tended to assume that the user had clicked on the wrong thing and not noticed. In the worst-case scenario, they would navigate directly to the porn site, see that it wasn’t trying to install anything malicious, and tell the user there was no problem. All in all, it was a da...