Feeds

Fast flux foils botnet takedown

Many-headed foe hard to combat

Top 5 reasons to deploy VMware with Tegile

Network security analyst Lawrence Baldwin has helped take down his share of bot nets, but he worries that those days may largely be over.

Traditional bot nets have used Internet relay chat (IRC) servers to control each of the compromised PCs, or bots, but the central IRC server is also a weakness, giving defenders a single server to target and take down. An increasingly popular technique, known as fast-flux domain name service (DNS), allows bot nets to use a multitude of servers to hide a key host or to create a highly-available control network. The result: No single point of weakness on which defenders can focus their efforts.

Last month, two significant online threats - the Storm Worm and a recent MySpace web virus - became the latest malicious programs to incorporate fast-flux hosting into their infrastructure. A recent Storm Worm infection, for example, connected to a bot net that had more than 2,000 redundant hosts spread amongst 384 providers in more than 50 countries, said analyst Baldwin, who is the chief forensics officer for myNetWatchman.com.

"That is what you would have to take down in order to shut down the bot net," he said. "It's already ridiculous trying to get an IRC command-and-control server taken down. Now, we are talking about a bot net, that in order to disable it, you have to take down thousands of hosts."

The change in tactics is bad news for defenders. Compromised PCs controlled by attackers - alternately referred to as bots or zombies - are increasingly being used in a variety of cybercrimes.

In late April and early May, networks of zombie PCs were used to attack the web sites and infrastructure of the government in the Northern European country of Estonia. In June, the FBI announced that the agency had identified more than a million compromised PCs infected by bot software.

Bot-net controllers, also known as bot masters, typically search such systems for financial information and use stealthy keylogging software to record usernames and passwords. The systems are also frequently used to overwhelm corporate networks with garbage data in denial-of-service attacks or send spam advertising penny stocks, fake pharmaceuticals or job scams. At any given time, there are 1.5 million different zombie computers sending spam, according to security firm Secure Computing, which estimates that 50 million computers are currently compromised with bot software.

Fast-flux bot nets use the Internet's look-up system for domain names against defenders. With a typical domain, the IP address associated with the domain does not change often, if at all. Fast-flux DNS uses a large number of servers and a fast-changing domain record to turn shutdown attempts into a game of whack-a-mole. A related technique, known as rock phishing, uses a large number of proxies to hide the location of a smaller number of critical servers. The computers typically protected by these methods include the command and control servers for bot nets, phishing sites, caches of stolen data, and sites that push malicious code out to other compromised systems.

"Most of us have heard of bulletproof web hosting - well, this is just a bulletproof bot net," Baldwin said.

Bot programmers have borrowed the technique from spammers. Spam networks have used fast-flux DNS to hide mail servers for several years, and during the late 1990s, when many users still connected to the Internet via dial-up modems, spammers used a variant of fast-flux DNS to point compromised PCs to currently available download servers, said Tom Shaw, the chief engineer for the Okie Island Trading Company, a small aerospace software contractor. Shaw has investigated a number of bot nets as part of his job.

"If you infected enough machines in the dial-up world, you could have a constant presence in the online world, even those these machines were popping on and off," he said.

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.