The Wikipedia article about CryptoLocker says:
In late-October 2013, security vendor Kaspersky Labs reported that with the help of a researcher, it had created a DNS sinkhole to block some of the domain names used by CryptoLocker.
The Wikipedia article about DNS sinkhole says:
A DNS sinkhole, also known as a sinkhole server, internet sinkhole, or BlackholeDNS is a DNS server that gives out false information, to prevent the use of the domain names it represents. The most common use is to stop botnets, by interrupting the DNS names the bot net is programmed to use for coordination. Sinkholes can be used both constructively and destructively, depending on the target.
How does this work? Who can sinkhole domains? I‘m a DNS layman, so please bear with me.
As far as I understand it, you need to control/own one of the top DNS servers that other DNS servers use, right? That way all the other DNS servers get the updated (= wrong) IPs for the domains in question. Otherwise you’d only reach a small number of users (e.g. those that use a specific custom DNS server you control etc.).
So does it mean that "Kaspersky Labs and the researcher" control such a DNS server? Or does it mean that they simply identified the domains in question and submitted them to the DNS server operators (in the hope that they’d block them)? Or is there a way to sinkhole the domains without controlling a DNS server?
And is there a way to notice that a domain is sinkholed? Maybe a flag or something? Or is the only way to consult an additional, alternative DNS server and compare the resolved IPs?