It seems like there's a simple solution here, using a common (albeit unpopular) technique. Many ISPs, when their DNS is queried for a non-existent address, will return a fake response which, through a hand-waving combination of DNS and HTTP, redirects the user's browser to a web page at that ISP. Those pages typically say "That site doesn't exist, did you mean this other one, and BTW here are some ads." This same technique is also used very effectively by OpenDNS for internet filtering. (The good kind, not the evil kind.)
So... what if the FBI set up a PSA (Public Service Announcement) captive portal solution using this technology? It's easy enough to set up: cache client IP addresses with a 1-hour sliding timer, i.e. each DNS query resets the clock. If the client IP is in the list, send the query to the real DNS. If the client IP isn't in the list, forward the query to the PSA DNS with a 0 TTL. The browser will load & display the PSA page.
The PSA page should include a brief description of what happened - malware blah blah cleaned blah blah make this change before July 9 blah blah click here to see the official FBI page - as well as directions on re-setting the DNS to its proper value, most likely the DHCP DNS setting. At an obvious location in the page, there's a link to the website the user was trying to visit. (Easy to rebuild using the host: HTTP header and the page request.) Click the link, the client DNS resolves via the real DNS, and the user merrily goes onto the Internet.
Standard traffic stat tools, like the DNS server log, should show whether it's working: each client IP should show up in the web server access log, and over time, the number of clients served should drastically decrease.
It seems like someone is missing something obvious: is it the FBI, or is it me?
Both privacy advocates and small government proponents are opposed to governmental organizations (especially executive branch, law enforcement types) running services for citizens. The FBI had to obtain a court order to be able to run the interim system and they have had to obtain multiple extensions. They would need an unprecedented permanent order to run a service for infected clients.
ReplyDeleteThe proposal here is for a transition mechanism: let people know they're using a soon-to-be discontinued service, and how to get that service elsewhere.
ReplyDelete