DNS Firewall Against Botnets and Phishing

SWITCH offers the universities DNS firewall lists which protect against malware and phishing.

Some modern malicious code is organized as a botnet. This means that the infected computer can be abused as a slave (bot of robots) by a Command and Control Master (C&C). Today, the malicious code is usually a Trojan that does not have its own spreading mechanism, but is infiltrated into the computer by various means.

To avoid direct combat by blocking communication with the master, botnets rely on changing IP numbers or changing DNS names.

Phishing stands for the sometimes abundant password harvest that an inquiring party can capture with a simple pretext via e-mail. Advanced techniques send the victim a link to a website that the victim mistakenly believes to be her normal login. Email messages with phishing content are often local, e.g. within Switzerland, and do not have a conspicuously large number of addressees. Where this has been detected and reported within Switzerland, the one or other password theft can be prevented by a quick blockade. This is so important because experience shows that the stolen passwords are used to distribute malicious code and further phishing via e-mail.