Speaker 1: Welcome to tech Stuff, a production of I Heart Radios
Speaker 1: How Stuff Works. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland. I'm an executive producer with
Speaker 1: How Stuff Works and iHeart Radio and I love all
Speaker 1: things tech, and it is time for another tech Stuff
Speaker 1: classic episode. This episode originally published on May two thousand twelve,
Speaker 1: and my former co host and editor Chris Pallette and
Speaker 1: I sat down to talk about operation ghost Click and
Speaker 1: domain name servers and this issue that was going on
Speaker 1: at the time, and I think it's pretty fascinating. It
Speaker 1: also gives you an idea of how d n S works.
Speaker 1: So I hope you enjoy this classic episode. To get there,
Speaker 1: you follow Highway fifty eight going northeast out of the city,
Speaker 1: and it is a good highway and new all right,
Speaker 1: we're talking about numbers today, yes we are. We're talking
Speaker 1: about getting to where you're going and getting diverted along
Speaker 1: the way. So, as of the recording of this podcast,
Speaker 1: which is in April, there is a story that's actually
Speaker 1: not a news story necessarily. It first started to kind
Speaker 1: of make the news way back in November of but
Speaker 1: it's kind of sort of bubbled up and It's an
Speaker 1: operation that the FBI, the Federal Bureau of Investigations, has
Speaker 1: headed up, and it all involves hacking into the Internet
Speaker 1: and uh and and messing around with Internet traffic. It's
Speaker 1: called Operation Ghost Click. That's a nice name. I always
Speaker 1: love hearing the operation names. It is a wacky doctors game. So, um,
Speaker 1: I think first, before we get into too much detail,
Speaker 1: we should probably talk about how internet traffic works. We've
Speaker 1: mentioned that on the podcast on a handful of occasions.
Speaker 1: I think when in fact we got into the domain
Speaker 1: name system DNS system or sorry that was redundant, the
Speaker 1: d N s uh no servers um well are both
Speaker 1: because DNS can can mean both, but right, right, right,
Speaker 1: So yeah, we talked about it before. And basically every
Speaker 1: website has a is um as an address, a physical address,
Speaker 1: well physical address on on a hard drive, a physical
Speaker 1: hard drive somewhere, and these numbers, there are are four
Speaker 1: sets of numbers separated by periods, and that address is
Speaker 1: unique to that UM space on that physical hard drive somewhere.
Speaker 1: And so if you typed in UM h T T
Speaker 1: P colon slash slash and these this number, you will
Speaker 1: get to a website. Of course, that's very inconvenient because
Speaker 1: then you neither have to write down these numbers or
Speaker 1: bookmark them, or you know, you have to have some
Speaker 1: sort of weird total recall thing going on where you
Speaker 1: can just easily remember any series of numbers, which would
Speaker 1: would would make you incredibly useful, but it would also
Speaker 1: make you very rare. Most of us, most of us
Speaker 1: are just not It's not something humans are particularly good
Speaker 1: at doing on average. So that is what kind of
Speaker 1: gave rise to the idea of having this domain name system. Yes, now,
Speaker 1: domain name system, what it does is it allows you
Speaker 1: to create a domain name as in words that correspond
Speaker 1: to whatever your site is, and then that itself is
Speaker 1: mapped to this series of numbers, this i P address right,
Speaker 1: the i P being Internet protocols UM, which is the
Speaker 1: the language that gets uh, you know, you from one
Speaker 1: place to another on the Internet, regardless of whether you're
Speaker 1: using a Windows machine, Mac or Linux or mobile thing.
Speaker 1: It gets you to the same place. And what allows
Speaker 1: you to type in how stuff works dot com and
Speaker 1: get to our website. Yes, so if you were to
Speaker 1: type how stuff works dot com, what have is that request?
Speaker 1: You know, you know, what you're essentially doing is you're
Speaker 1: telling your browser, I want access to this particular website.
Speaker 1: Your browser sends this message along up a chain of command,
Speaker 1: and uh, you know, it has to go out to
Speaker 1: the right computer that has the website living on it
Speaker 1: and retrieve that so that you get an instance of
Speaker 1: it back at your machine. In order to do that,
Speaker 1: it has to first map that one needs to have
Speaker 1: is the name that you're typing. It has to be
Speaker 1: mapped to that physical machine, that physical drive. Uh, and
Speaker 1: it does this by going through domain name servers. A
Speaker 1: domain name server is essentially like think of it kind
Speaker 1: of like a phone book. Yeah, so that all the
Speaker 1: different u r l s you could type in are
Speaker 1: indexed against these number numerical addresses. And then that way,
Speaker 1: once you type in the u r L, it looks
Speaker 1: for the corresponding numeric address, owls information from that that
Speaker 1: particular source, and then serves it back to you so
Speaker 1: that you get what you asked for. Well that you
Speaker 1: asked for it, you got it anyway. So, um, the
Speaker 1: whole deal here is that you are going to get
Speaker 1: the right information. Yeah, assuming that everything's working correctly, and
Speaker 1: occasionally stuff messes up. There might be uh, the computer
Speaker 1: that hosts, the site might be down, in which case
Speaker 1: you're going to get something like a four or four
Speaker 1: error because the Internet is not going to be able
Speaker 1: to find the file that you've requested. We're very sorry.
Speaker 1: The Internet is broken. The elders of the Internet called
Speaker 1: and they said, no more Internet for you. But most
Speaker 1: of the time it's gonna work just fine. However, what
Speaker 1: happened in the case of Operation ghost Click is that, uh,
Speaker 1: the FBI discovered there were some people who had created
Speaker 1: some rogue DNS servers. So, in other words, these get
Speaker 1: these folks, six Estonian nationals, according to the FBI, um
Speaker 1: got together and created these servers that acted just as
Speaker 1: a domain named server would. So in other words, it
Speaker 1: had a collection of u r l s and index
Speaker 1: of u r l s and an index of addresses
Speaker 1: numeric addresses. So it was like a fake phone book,
Speaker 1: right Exactly. Some of the entries in this fake phone
Speaker 1: book went to different phone numbers, so instead literally yeah,
Speaker 1: but we're we're sticking with the analogy, sticking with that analogy,
Speaker 1: just making so instead of the official phone number for
Speaker 1: a particular website, you would get a fake one, and
Speaker 1: it would in other words, that you would go to
Speaker 1: a fake numeric address for a real site. So you
Speaker 1: might type in the address perfect in your u r
Speaker 1: L bar. Right, So let's take a random example. Let's
Speaker 1: just say Yahoo. So you do www dot Yahoo dot com.
Speaker 1: You hit enter. Now, normally, in a regular DNS server,
Speaker 1: it would look up that you are L, look to
Speaker 1: see what the numeric address is for that you are L,
Speaker 1: send that information out, retrieve the website, and serve it
Speaker 1: up to you. A rogue DNS server would look up
Speaker 1: that u r L, look at the numeric address that
Speaker 1: was created for that u r L, But it isn't
Speaker 1: actually the address for Yahoo. It's an address for something else,
Speaker 1: and it serves that up to you. Now, why would
Speaker 1: anyone do this? There are a couple of different reasons. Now,
Speaker 1: in the case of the Estonians, and they were doing
Speaker 1: something I think that was kind of uh deviously clever.
Speaker 1: They were doing this in order to reroute traffic to
Speaker 1: break in advertising money. So in other words, what they
Speaker 1: wanted to do was the way advertising on the Internet
Speaker 1: works in general is that you get paid for a
Speaker 1: certain number of views of the ad. It's called impressions.
Speaker 1: The number of impressions and ad gets that translates to money.
Speaker 1: And if you get lots and lots and lots of impressions,
Speaker 1: you get lots of money. Um. Then in general a
Speaker 1: single impression is worth a fraction of assent. Yeah, but
Speaker 1: if you can say, hey, you know, I can promise
Speaker 1: you that five million people are going to say your ad,
Speaker 1: then you can command a good price for your services. Right, So,
Speaker 1: very popular websites can tend to charge more than sites
Speaker 1: that don't get a lot of traffic. Makes makes sense. Right.
Speaker 1: Let's say that you have a billboard next to a
Speaker 1: busy highway. The price for that billboard to to to
Speaker 1: put it out on that billboard's probably gonna be higher
Speaker 1: than a billboard that's next to a rural road that
Speaker 1: doesn't get a lot of traffic. So anyway, the same
Speaker 1: sort of logic applies on on the web. So what
Speaker 1: these guys were doing, I say guys, what these Estonians
Speaker 1: were doing because I don't know their gender, Uh, they
Speaker 1: were they were using these rogue DNS servers to reroute
Speaker 1: traffic to go to different websites and that had specific
Speaker 1: ads on them that the Estonians were administering, and then
Speaker 1: they were pulling in the money. So they were redirecting traffic.
Speaker 1: It's like putting in a detour in your route. And
Speaker 1: so you're going down your normal route to get to
Speaker 1: wherever you're going, and you see a sign that says, oh, nope,
Speaker 1: the road is out. Up ahead, take a right instead
Speaker 1: of going straight, and you will go through a different route.
Speaker 1: And along that route you decided to stop and eat.
Speaker 1: And normally you would stop and eat at your favorite restaurant,
Speaker 1: but you can't get to that one because it's on
Speaker 1: the road that's been closed. So you go to this
Speaker 1: other restaurant and it all turns out that it was
Speaker 1: employed by the other restaurant in the first place. They
Speaker 1: put that detour sign up because they wanted to get
Speaker 1: some more foot traffic or some more some more diners
Speaker 1: to come in. That was the general plan. Now, the
Speaker 1: question is how do you get that rogue DNS server
Speaker 1: to get in the line of traffic so that people
Speaker 1: will visit it in the first place. Yeah, because if
Speaker 1: you're typing in an address that you already know, say
Speaker 1: Discovery dot com, you should theoretically be routed to the
Speaker 1: right place. As long as your computer is configured correctly
Speaker 1: and the Internet is working. The way it's supposed to.
Speaker 1: I mean, what are they gonna do. Are they gonna
Speaker 1: go in and kick out the legitimate DNS machine and
Speaker 1: replace it. No, it was very clever. They created a
Speaker 1: kind of malware and the malware is essentially called d
Speaker 1: n s changer, and so DNS changer would change the
Speaker 1: DNS settings on your computer or other device or even router,
Speaker 1: which was particularly nasty because if it changed on the router,
Speaker 1: then any device that connects through that router would be affected. Also,
Speaker 1: it's unlikely that you're going to have anti virus software
Speaker 1: on your router, although you might on your computer now.
Speaker 1: The way that they did this with the router was
Speaker 1: the easiest way, and it's the easiest way for someone
Speaker 1: to prevent it from happening to them. The way that
Speaker 1: worked on the router was that they just ended up
Speaker 1: using a list of generic user and names and passwords
Speaker 1: that are that tend to be um UH administered over
Speaker 1: various routers. So you pick pick a router, like whatever
Speaker 1: router you you happen to use, that router tends to
Speaker 1: have a standard user name and standard password that you
Speaker 1: are supposed to change once you install it into your
Speaker 1: home network. But a lot of people never get around
Speaker 1: to doing that. They install the the the router and
Speaker 1: then they don't bother changing the user name and password,
Speaker 1: which means that anyone who knows what the standard user
Speaker 1: name and password is for that brand of router could
Speaker 1: get access to that network. That's what they were doing
Speaker 1: in this case. But in order to change the computers themselves,
Speaker 1: not the router, what they had to do was convince
Speaker 1: people to download some malware and execute that. Now, social engineering, yeah,
Speaker 1: lots of different ways of doing that. You know. There's
Speaker 1: the very standard way where they include some uh they
Speaker 1: put on on a website that you might encounter, or
Speaker 1: a little pop up that says, hey, your antivirus software
Speaker 1: is out of date. Install this and we will scan
Speaker 1: your computer for viruses and free, yeah, for free. And
Speaker 1: in fact it really is a virus itself that installs
Speaker 1: to your computer. You know, you think you are trying
Speaker 1: to head off some sort of malware and in fact
Speaker 1: you're actually installing malware to your computer at the time,
Speaker 1: or it can be through email attachments, you know, all
Speaker 1: the standard ways that malware propagates across the web. Any
Speaker 1: of that would work to get this this particular kind
Speaker 1: of malware onto your machine. Once you installed it, whether
Speaker 1: it was through a trojan program or whatever, it would
Speaker 1: go and reset the DNS settings on your computer, and
Speaker 1: it would direct your computer to go to these rogue
Speaker 1: DNS servers as opposed to your Internet Service providers DNS servers,
Speaker 1: because h I SP has its own right that passes
Speaker 1: the information up along the chain of command, so you
Speaker 1: would bypass your I s P S servers. You would
Speaker 1: go to these rogue servers, and then you would be
Speaker 1: directed to whatever website they wanted to direct YouTube for
Speaker 1: any particular u r L. For some u r l s,
Speaker 1: you might just get the regular website you you're sent
Speaker 1: along and nothing bad happens. For other u r l s,
Speaker 1: you might be directed to a site that looks very
Speaker 1: similar to the one you wanted, but something isn't quite right,
Speaker 1: and it tends that again, they were just doing it
Speaker 1: for the advertising money. The scary thing is they could
Speaker 1: have done this for any other reason and actually tried
Speaker 1: to steal stuff directly from the user. Now in this case,
Speaker 1: that doesn't seem to be what they were up to.
Speaker 1: They were up to just redirecting that traffic. So you
Speaker 1: might think, well, that's annoying. I mean, I'm not going
Speaker 1: to get to the website I want to go to
Speaker 1: unless I type in the actual uh numeric address physically,
Speaker 1: then I would go to it. But Uh, while it's
Speaker 1: annoying that I wouldn't go to the site that I
Speaker 1: wanted to go to, at least they're not stealing from me.
Speaker 1: But they could have. They could have directed things so
Speaker 1: that you would go to dummy websites that look similar
Speaker 1: to official ones and put in a system where you
Speaker 1: type in your user name and password and they would
Speaker 1: log it. They could have logged it, they didn't. They
Speaker 1: could have logged that information, thus getting access to various
Speaker 1: accounts across the Internet. They could have gotten access to
Speaker 1: email accounts, bank accounts, you know, any other sort of
Speaker 1: anything that would require authorization. They could have done that. Uh,
Speaker 1: And what would probably have happened is that you would
Speaker 1: have logged in. Let's say that you try to go
Speaker 1: to your banks online banking site and you might get
Speaker 1: a site that looks very much like your banks site.
Speaker 1: In fact, it might even look almost identical. Um, the
Speaker 1: address might look a little hinky, but if you were
Speaker 1: the type of you use the name and password. Likely
Speaker 1: you would get a response saying, oh, sites down for maintenance.
Speaker 1: But what's really happened is that that information has been
Speaker 1: logged by hackers. That could have happened, or they could
Speaker 1: have directed you to a site where you would have
Speaker 1: been encouraged to download even more malware, perhaps a back
Speaker 1: door access programs that you are your computer would become
Speaker 1: part of a bot net or any other kind of
Speaker 1: of hacking tool. It's it's really the options are pretty
Speaker 1: much unlimited. Now. In this case, again it was just
Speaker 1: to redirect traffic. However, there were some other problems that
Speaker 1: would happen if you were affected by this virus. You
Speaker 1: might not you know, you might not have anyone stealing
Speaker 1: from your bank account or anything. But one of the
Speaker 1: things the virus does, which is pretty much standard operating
Speaker 1: procedure for viruses, is it turned off the features on
Speaker 1: your operating system and your anti virus from updating so
Speaker 1: that you wouldn't be able to get the latest security
Speaker 1: patches that would prevent this this UH program from working.
Speaker 1: So first step pretty much of any malware is let's
Speaker 1: disable the stuff that can turn this off. So anything
Speaker 1: that would automatically turn the the malware off was disabled.
Speaker 1: So that's a problem because it means that even if
Speaker 1: you aren't being actively preyed upon by these particular hackers, uh,
Speaker 1: future attacks could hit you much more easily because you
Speaker 1: are no longer protected, which is pretty bad. That's what
Speaker 1: we call a bad thing and Internet security. And there
Speaker 1: were about what four million people around the world and
Speaker 1: about a hundred countries that were affected by this, and
Speaker 1: then thousand in the United States. And it wasn't just uh,
Speaker 1: you know, citizen users, it was also businesses, government, government computers. UM.
Speaker 1: I think there were even like a couple of computers
Speaker 1: over at NASA that were affected to this. And uh.
Speaker 1: And the good news that we have is that the
Speaker 1: FBI arrested these six Estonian nationals that were identified as
Speaker 1: being part of this running actually running this ring. Yeah,
Speaker 1: they were going to try to have them extraditedto the
Speaker 1: United States. Yeah. And they've also taken over the rogue
Speaker 1: DNS servers they have identified as being part of this,
Speaker 1: and those rogue DNS servers are now acting like legitimate
Speaker 1: DNS servers, which is great. That means that as a user,
Speaker 1: when you try to visit a website, you should get
Speaker 1: what you're supposed to get. However, there's a problem because
Speaker 1: your computers still have if you're affected, your computer still
Speaker 1: is directing you to the wrong set of servers. You're
Speaker 1: still getting the right result, but you're going and you're
Speaker 1: not going to the regular chain of command that you
Speaker 1: should go to. And the FBI is not going to
Speaker 1: be running these servers forever, and in fact, in in July,
Speaker 1: they're going to turn them off. And once those turn off,
Speaker 1: if your computer is being directed to those DNS servers,
Speaker 1: you may not have any more Web access, at least
Speaker 1: not through typing in a normal U r L, because
Speaker 1: your computer is going to try and go through a
Speaker 1: pathway that doesn't exist anymore. Chris and I have more
Speaker 1: to say about Operation Ghost Click, but before we get there,
Speaker 1: let's take a quick break to thank our spawn, sir. So,
Speaker 1: the important thing to do is to determine whether or
Speaker 1: not your computer has this infection, and if it does
Speaker 1: have the infection, to clear it up. And uh, it's
Speaker 1: the first one is easier than the second one. The
Speaker 1: FBI actually set up a website designed to help you
Speaker 1: identify whether or not you have been affected. Yes, um,
Speaker 1: you can go to the FBI's website and follow the
Speaker 1: links to find out about whether or not your computer
Speaker 1: has this problem. And there's actually a couple different ways
Speaker 1: of doing it. There's they've they've set up a u
Speaker 1: r L where what it does is it pings a
Speaker 1: server and if it gets a positive result saying that
Speaker 1: you're fine, uh, you get a screen that has this
Speaker 1: big green icon on it and says you're good. Um.
Speaker 1: If you're not fine, you get a big red icon
Speaker 1: which says this is saying that you're you know, it's
Speaker 1: going through one of the rogue DNS servers. They've also
Speaker 1: identified a range of the IP addresses that you know.
Speaker 1: You can check your DNS settings on your computer yourself.
Speaker 1: If you're using a Windows machine, you go to a
Speaker 1: run command and you type an IP configured slash all uh,
Speaker 1: and then that'll pull up your DNS settings and you
Speaker 1: can see what the what the numeric address is for
Speaker 1: the server that you go to, and if it falls
Speaker 1: within the range that's been identified by the FBI, you
Speaker 1: know that your DNS settings are wrong. Clearing this up
Speaker 1: and getting rid of the malware is a little tricky. Uh.
Speaker 1: The easiest way I can think of to do it
Speaker 1: if I were doing it myself. Is going to a
Speaker 1: computer that I know has not been affected and downloading
Speaker 1: the latest antivirus software I can find and putting Most
Speaker 1: of them have an option where you can put a
Speaker 1: version of that onto a thumb drive. Do that, then
Speaker 1: take the thumb drive over to the infective machine and
Speaker 1: booted into safe mode, and load up the anti virus
Speaker 1: software from the thumb drive, and that should be able.
Speaker 1: Depending upon the anti virus software, it should be able
Speaker 1: to scan it and remove it. Um. The FBI also
Speaker 1: points to several web assets that can help you if
Speaker 1: your computer does appear to be one of the ones
Speaker 1: that infected, and those may work very well for you.
Speaker 1: I tend to go with the anti virus approach whenever
Speaker 1: I can. UM it just I don't know, I don't
Speaker 1: know it is. I just have a preference for that
Speaker 1: as opposed to going like a web based route. Yeah. Yeah, um,
Speaker 1: but it is. It is fairly easy to uh to
Speaker 1: get rid of the problem in this case. It's not
Speaker 1: like some of the others where you have to UH
Speaker 1: reformat your hard drive to get it back. Yeah. I mean,
Speaker 1: there's there's something depending on how tech savvy you are,
Speaker 1: it's pretty easy. If you're not terribly tech savvy, it
Speaker 1: maybe it may be worth it to take it to
Speaker 1: a computer professional to have them scan it and remove
Speaker 1: it and take care of it for you, because the
Speaker 1: more you mess with your computer settings, the more you
Speaker 1: may inadvertently cause some problems that can turn your machine
Speaker 1: into a nightmare. Um and and sometimes depending on the malware,
Speaker 1: like if you've had this on your computer for a while,
Speaker 1: that might not be the only malware that's affecting you.
Speaker 1: You might have other problems, in which case, uh, you know,
Speaker 1: a simple scan and remove may not be enough. In
Speaker 1: a worst case scenario, you might have to do something
Speaker 1: like wipe your computer and reinstall the operating system, in
Speaker 1: which case the first thing you want to do is
Speaker 1: back up as much of your data as you possibly
Speaker 1: can and then you do the wipe. But that even
Speaker 1: that is I mean, that's that's like a worst case
Speaker 1: scenario type of thing, and hopefully none of our listeners
Speaker 1: are in that well. First of all, hopefully none of
Speaker 1: our listeners have been affected by this malware, but if
Speaker 1: they have, hopefully it's not so severe. Letting they don't
Speaker 1: have other forms of malware that they can't you know, uh,
Speaker 1: take care of it themselves. Yeah. Um, and of course
Speaker 1: it's always a good idea to back up your hard
Speaker 1: drive on a regular basis anyway, just to make sure
Speaker 1: they always back up your hard drive to h to
Speaker 1: make sure that you have a version of your operating
Speaker 1: system uh installed on there that you can go back
Speaker 1: to that you know is not infected at least hopefully. Yeah.
Speaker 1: But that's that's that's pretty impressive. I mean, the FBI
Speaker 1: has really been promoting the fact that they they had
Speaker 1: this success in taking down or apparent success I should say,
Speaker 1: and taking down this uh this ring, this ring, because um,
Speaker 1: you know this is this is pretty significant. They took
Speaker 1: away traffic from uh legitimate websites in addition to making
Speaker 1: money for themselves with the the alternate fake websites. Um.
Speaker 1: And it does expose the fact that most people are
Speaker 1: are you know, still having to to think about what
Speaker 1: they do because they they may very well be letting
Speaker 1: somebody in. It could have been a lot worse than
Speaker 1: it was. Yeah, exploiting the DNS system, which again I know, redundant,
Speaker 1: a t M machine, uh, exploiting that pin number, Um,
Speaker 1: it was pretty ingenious, you know, Essentially, it just shows
Speaker 1: that understanding how the Internet works and building this parallel
Speaker 1: system that exploits the way Internet works was very clever. Now,
Speaker 1: of course, it's still depended upon user behavior to work,
Speaker 1: because if no one had downloaded the malware, if no
Speaker 1: one had installed the malware, it wouldn't have um nothing
Speaker 1: would have happened. You would have had these DNS, these
Speaker 1: rogue DNS servers that would be online and would be
Speaker 1: ready to redirect traffic to wherever they wanted it to go.
Speaker 1: But if no one downloaded the malware, the traffic would
Speaker 1: never have been redirected. So really, the other lesson to
Speaker 1: take away from this is just practice good Internet security
Speaker 1: rules of thumb, things like don't open strange attachments from
Speaker 1: you know, in random emails, make sure you ask people
Speaker 1: if they've sent you an attachment, asked them like, did
Speaker 1: you really send this to me? Because sometimes people their
Speaker 1: email address gets compromised and they randomly start sending out
Speaker 1: files to people, often in uncharacteristically uh worded ways, Like
Speaker 1: you might read a message and think, either my friend
Speaker 1: is taking a terrible fall and decided to email me
Speaker 1: immediately afterward, or is under the influence of some powerful
Speaker 1: alcohol or you know, it just doesn't make any sense.
Speaker 1: Like you read it and you're like, this doesn't sound
Speaker 1: like Chris. Chris never emails me in all caps with
Speaker 1: lots of letters missing. Um, you know, send this to
Speaker 1: everyone you know. Um, Bill Gates will give you twenty
Speaker 1: five cents for every email that you've forard anyway, don't
Speaker 1: don't open those email attachments. Yeah, and you know what
Speaker 1: I recently realized. Um, every once in a while, I
Speaker 1: find a story that I want to send to somebody,
Speaker 1: and I've I've realized that I was sending it. I'd say, hey,
Speaker 1: I just saw this, you should check it out. You
Speaker 1: know what. That sounds just like something a spam or
Speaker 1: would writ right, So I try to make it a
Speaker 1: little more personally personal so that the well, for one thing,
Speaker 1: the spam filter will on a lot of these uh
Speaker 1: uh services will we'll pull it right out of there
Speaker 1: if you if it's something that that minimal. So if
Speaker 1: it fits that pattern of hey I saw this, check
Speaker 1: it out, and then yeah, it can fall into the
Speaker 1: spam filter pretty easily. Also, And it doesn't just go
Speaker 1: with attachments like I mean, or links. There are links,
Speaker 1: plenty of links are problems, but think about gosh, I've
Speaker 1: seen this so many times on Facebook. Click jacking on Facebook.
Speaker 1: We're in the home stretch for Operation Click. But before
Speaker 1: we click on any more ghosts, we're gonna take a
Speaker 1: quick break to thank our sponsor. So if you've ever gone,
Speaker 1: I'm sure most of you have. Anyone who's had a
Speaker 1: Facebook account long enough has seen this happen with their friends.
Speaker 1: You'll look and there'll be some video link. You know,
Speaker 1: it'll say. It won't be an embedded video, so it's
Speaker 1: not something that plays within Facebook, but you'll see like
Speaker 1: a link to some incredible video and it usually has
Speaker 1: to do with either violence or sex. Those tend to
Speaker 1: be the two big ones. Yeah. Yeah, you go for
Speaker 1: those base instincts that we humans have and uh and
Speaker 1: you get a lot of results, which is kind of
Speaker 1: a sad commentary, but that's a different podcast. Anyway, there's
Speaker 1: a you know, you'll you'll see this link And I
Speaker 1: saw one recently and immediately I was like, my red
Speaker 1: flag went up as soon as I thought. First of all,
Speaker 1: I was like, this doesn't seem like the kind of
Speaker 1: thing this person would have shared, Like they might have
Speaker 1: clicked on a link but it doesn't seem like something
Speaker 1: they would have themselves shared. And it was a supposedly
Speaker 1: a video about Justin Bieber being stabbed at a concert,
Speaker 1: and as soon as I saw it, I thought, uh,
Speaker 1: this has click clickjacking written all over it, And immediately
Speaker 1: I went to one of my favorite references for this
Speaker 1: sort of thing, snopes dot com. So Snopes is all
Speaker 1: about urban legends, but they also look at things like
Speaker 1: internet hoaxes and and click jacking. And I did a
Speaker 1: quick search and sure enough, this is something that's been
Speaker 1: around for a while, and it just it's just like
Speaker 1: a lot of other clickjacking. It has these cycles that
Speaker 1: goes through where you'll have an initial pop up of
Speaker 1: this and then it dies down, and then it'll pop
Speaker 1: up again, and I'll do that three or four times.
Speaker 1: Current events are often yeah, and I mean it's it's
Speaker 1: you'll find some of these that are that have lasted
Speaker 1: for years that basically they don't necessarily you have to
Speaker 1: be about Justin Bieber, for example, that maybe the uh
Speaker 1: the click jack to jure, Yeah exactly, or you know,
Speaker 1: five years ago it could have been about for example,
Speaker 1: Britney Spear. Yeah, that would be a very popular one
Speaker 1: and Jennifer Anniston or somebody somebody that's in the news
Speaker 1: right that moment. Yeah, and it tends to be like
Speaker 1: or or it'll be like this this this news anchor
Speaker 1: had an embarrassing moment on the news. Click to find
Speaker 1: out that sort of stuff. And what happens is if
Speaker 1: you do click that, you'll get a message that essentially
Speaker 1: says usually something like, uh, your your you need to
Speaker 1: install this extension or you need to install this video
Speaker 1: player in order to watch this video. And if you
Speaker 1: allow it, then it gets access to things like your
Speaker 1: Facebook feed and as well as possibly other stuff. It
Speaker 1: may involve other, you know, kinds of malware, but in general,
Speaker 1: you've seen see this get propagated across Facebook where someone
Speaker 1: who has fallen from the trick agrees to it, and
Speaker 1: then it continues to go across Facebook because it starts
Speaker 1: to use that person's feed. So whenever I see one
Speaker 1: of these, here's what I do, guys. I immediately, you know,
Speaker 1: I see something that that raises a red flag like that,
Speaker 1: first way I do is I do a search on
Speaker 1: on Google for whatever the video supposedly shows, because nine
Speaker 1: times out of ten, it's just completely made up, and
Speaker 1: you can usually find up I find an article written
Speaker 1: on it, or it'll be on Snopes or something like
Speaker 1: that where I'll say, you know, this new Facebook scam
Speaker 1: is going around, so watch out for it. Once I
Speaker 1: have confirmed that it's a scam, I go back to
Speaker 1: Facebook and I comment on the entry and I say, Hey,
Speaker 1: it looks like this is a clickjacking attempt. You may
Speaker 1: want to go and and change your Facebook password and
Speaker 1: delete this post because by deleting the post, you're going
Speaker 1: to help remove that that step for other people to
Speaker 1: fall victim to that same problem. So I that fairly
Speaker 1: regularly because I've got a lot of friends on Facebook,
Speaker 1: and this sort of thing can happen to anyone. It's
Speaker 1: uh and it's not necessarily something that's that's sort of
Speaker 1: either appealing to violence or sex. Sometimes it's something that's
Speaker 1: just interesting and it has nothing to do with any
Speaker 1: of those uh uh kind of more base subject matter.
Speaker 1: And also, I mean in general, when there's a link
Speaker 1: in Facebook, if it's a link in Facebook, I tend
Speaker 1: to go to Google anyway and try and get to
Speaker 1: that link without going through Facebook, because you never know
Speaker 1: when it's a clickjacking attempt. If it's an embedded video
Speaker 1: within Facebook, like a YouTube video that's been embedded in
Speaker 1: Facebook something like that, I'm all right with that. I'll
Speaker 1: watch it that way. But for links, I tend to
Speaker 1: go outside of Facebook to do it, just to be
Speaker 1: on the safe side, which I'm sure Facebook hates. That's
Speaker 1: not what Facebook wants to hear. But until they want
Speaker 1: to track you, right, until there's better security around that
Speaker 1: so that I'm not throwing caution to the wind and
Speaker 1: infecting my computer, I just I can't justify it. So
Speaker 1: that's just my own personal approach. Guys. I'm sure all
Speaker 1: of you probably have your own sort of way of
Speaker 1: dealing with this and avoiding problems, but it's always something
Speaker 1: that's good to keep in mind. Uh and UM. Anyway,
Speaker 1: So if you guys, suspect that you might have this
Speaker 1: DNS change your malware on your computer, go to the
Speaker 1: FBI's website. Use their tool first of all to see
Speaker 1: if you get a result back. If you don't get
Speaker 1: a result back, you're probably okay, not necessarily okay. You
Speaker 1: can pull up that list of addresses that do map
Speaker 1: to these rogue servers and go through your computer settings
Speaker 1: and confirm it that way warning rogue servers, So just
Speaker 1: check your computers, make sure you're you're fine, because if
Speaker 1: you're not fine, then once the FBI turns these servers off,
Speaker 1: you may have some problems accessing stuff over the web.
Speaker 1: And then you're thinking, what the heck happened? And that
Speaker 1: wraps up another classic episode of tech Stuff. Hope you
Speaker 1: guys enjoyed. It gives you a little bit of a
Speaker 1: glimpse into the past and this operation Ghost Click problem
Speaker 1: that was plaguing us in the spring of If you
Speaker 1: guys have any questions or maybe suggestions for future episodes,
Speaker 1: you can send me an email the addresses tech Stuff
Speaker 1: at how stuff works dot com, or pop on over
Speaker 1: to our website that's text stuff podcast dot com. That's
Speaker 1: where you're going to find links to all our classic episodes,
Speaker 1: including all of our new episodes. You'll also find links
Speaker 1: to our social media presence and a link to our
Speaker 1: online merchandise store, and every purchase you make there and
Speaker 1: goes to help the show, and we greatly appreciate it,
Speaker 1: and I'll talk to you again really soon. Text Stuff
Speaker 1: is a production of I Heart Radio's How Stuff Works.
Speaker 1: For more pod casts from my Heart Radio visit the
Speaker 1: I heart Radio app, Apple podcasts, or wherever you listen
Speaker 1: to your favorite shows. H