Feeds

Fast flux foils botnet takedown

Many-headed foe hard to combat

Protecting against web application threats using SSL

During one investigation for the Okie Island Trading Company in May, Shaw ran into a fast-flux bot net linked to a phishing site that mimicked a North Carolina bank.

A simple lookup on the phishing site's domain name - from China's address space - immediately turned up five different IP addresses. Rather than deal with shutting down a single server, Shaw now had to deal with five different computers, each likely owned by an unwitting end user infected with bot software. Yet, the attacker didn't stop at five: When Shaw rechecked the domain name six minutes later, three of the addresses had changed. Eventually, tens, or even hundreds, of Internet addresses would rotate through the name server.

"It's like a hydra, with all these heads," Shaw said. "The only way to kill it is to convince the registrar to shut down the domain."

Yet, registrars and Internet service providers are rarely eager to go after bot-infected customers. Shutting down an Internet address or a domain name could mean angering a legitimate customer and would likely lead to expensive support calls. It's no wonder that ISPs and registrars are hesitant to take down potentially infected machines, said Adam Waters, chief operating officer for Support Intelligence, which provides customers security monitoring services.

"When you call them up, you are asking them to take their customers offline," Waters said in a recent interview. "Any business that you ask to do that, well, they are going to be gun shy."

Earlier this year, Support Intelligence found a number of zombie computers that appeared to be located inside the networks of major corporations. When the company tried to contact the corporations involved, few returned the calls. So the security-monitoring firm started highlighting several companies on its blog - a move that brought quicker responses.

Getting registrars to take down domain names is even more difficult, however. And even if successful, repeating that success often enough to fully take down a bot net with distributed DNS is almost impossible, Waters said.

"Fast flux is not about the bad guys hiding where they are," he said. "They are in your face and saying, 'Come take us out.' And you can't."

Top-level domain name registrars - the arbiters of .com, .net, .org and the country-specific domains - could solve the problem by refusing to allow fast-changing domains or by making the takedown process for domains easier. However, making the use of such power routine would worry many people, said Gadi Evron, a bot-net expert and security evangelist for Beyond Security.

"Even if you enable some sort of control at the top-level domain, (you have to ask) do we really want to give them the authority to do that?" Evron said in a recent interview. "I'm all for it, because we have no controls in place to mitigate what is being abused, not to mention, prevent it all together."

Until takedown through the registrars become easier, defenders will have to resign themselves to increasingly difficult-to-disable bot nets, said Johannes Ullrich, chief technology officer for the SANS Internet Storm Center. In the past, only a third of bot nets lasted more than 24 hours. By design, fast-flux bot nets last much longer and, just by their ability to outlive IRC-based bot nets, will likely soon make up the majority of attack networks on the Internet.

"There may not be all that many more conversions to fast-flux DNS, but once we see a bot net converted to fast flux, it's likely that the bot net will be around for a long while," Ullrich said.

With the prospect of having to track down each infected PC, rather than a single key computer, security experts concerned about Internet safety should focus on stopping the initial spread of bot software, he added.

"You have to prevent it, because once you are infected, it's game over," Ullrich said.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.