Microsoft has settled a claim against No-IP, the dynamic domain name service which suffered a major disruption in late June when it was caught in Microsoft’s tenth malware takedown effort.
Late last week Microsoft handed back all 23 primary domains that it had seized from No-IP on June 30 after gaining a US court’s approval to tackle the Bladabindi (NJrat) and Jenxcus (NJw0rm) malware families.
Microsoft claimed the malware had infected around seven million machines over the past year and that No-IP’s dynamic DNS service was the malware’s primary source of malware control infrastructure.
On Wednesday, Microsoft and No-IP’s owner, Vitalwerks, announced they had reached a settlement, which includes permanently disabling the subdomains used as botnet control infrastructure.
“Microsoft has reviewed the evidence provided by Vitalwerks and enters into the settlement confident that Vitalwerks was not knowingly involved with the subdomains used to support malware. Those spreading the malware abused Vitalwerks’ services,” Microsoft said.
“Microsoft identified malware that had escaped Vitalwerks’ detection. Upon notification and review of the evidence, Vitalwerks took immediate corrective action allowing Microsoft to identify victims of this malware. The parties have agreed to permanently disable Vitalwerks subdomains used to control the malware.”
No-IP released an identical statement on its blog.
Microsoft was gunning for No-IP under the argument that it didn’t take sufficient steps to prevent criminals from abusing its services and cited several publicly available reports from security vendors that pointed to No-IP has a haven for criminal activity.
Microsoft’s domain seizure aimed at capturing and sinkholing over 18,000 malicious sub domains being used by the criminals. It said it would allow normal access to domains for good traffic, however No-IP claimed its “heavy-handed action” ended up blocking services used by millions of people.
Microsoft later admitted it had made a technical error and today reiterated its apology to No-IP customers affected by its action.
“In the process of redirecting traffic to its servers for malware detection, Microsoft acknowledges that a number of Vitalwerks customers were impacted by service outages as a result of a technical error. Microsoft regrets any inconvenience these customers may have experienced,” it said.
This article is brought to you by Enex TestLab, content directors for CSO Australia.