Feeds

Fast flux foils botnet takedown

Many-headed foe hard to combat

Security for virtualized datacentres

During one investigation for the Okie Island Trading Company in May, Shaw ran into a fast-flux bot net linked to a phishing site that mimicked a North Carolina bank.

A simple lookup on the phishing site's domain name - from China's address space - immediately turned up five different IP addresses. Rather than deal with shutting down a single server, Shaw now had to deal with five different computers, each likely owned by an unwitting end user infected with bot software. Yet, the attacker didn't stop at five: When Shaw rechecked the domain name six minutes later, three of the addresses had changed. Eventually, tens, or even hundreds, of Internet addresses would rotate through the name server.

"It's like a hydra, with all these heads," Shaw said. "The only way to kill it is to convince the registrar to shut down the domain."

Yet, registrars and Internet service providers are rarely eager to go after bot-infected customers. Shutting down an Internet address or a domain name could mean angering a legitimate customer and would likely lead to expensive support calls. It's no wonder that ISPs and registrars are hesitant to take down potentially infected machines, said Adam Waters, chief operating officer for Support Intelligence, which provides customers security monitoring services.

"When you call them up, you are asking them to take their customers offline," Waters said in a recent interview. "Any business that you ask to do that, well, they are going to be gun shy."

Earlier this year, Support Intelligence found a number of zombie computers that appeared to be located inside the networks of major corporations. When the company tried to contact the corporations involved, few returned the calls. So the security-monitoring firm started highlighting several companies on its blog - a move that brought quicker responses.

Getting registrars to take down domain names is even more difficult, however. And even if successful, repeating that success often enough to fully take down a bot net with distributed DNS is almost impossible, Waters said.

"Fast flux is not about the bad guys hiding where they are," he said. "They are in your face and saying, 'Come take us out.' And you can't."

Top-level domain name registrars - the arbiters of .com, .net, .org and the country-specific domains - could solve the problem by refusing to allow fast-changing domains or by making the takedown process for domains easier. However, making the use of such power routine would worry many people, said Gadi Evron, a bot-net expert and security evangelist for Beyond Security.

"Even if you enable some sort of control at the top-level domain, (you have to ask) do we really want to give them the authority to do that?" Evron said in a recent interview. "I'm all for it, because we have no controls in place to mitigate what is being abused, not to mention, prevent it all together."

Until takedown through the registrars become easier, defenders will have to resign themselves to increasingly difficult-to-disable bot nets, said Johannes Ullrich, chief technology officer for the SANS Internet Storm Center. In the past, only a third of bot nets lasted more than 24 hours. By design, fast-flux bot nets last much longer and, just by their ability to outlive IRC-based bot nets, will likely soon make up the majority of attack networks on the Internet.

"There may not be all that many more conversions to fast-flux DNS, but once we see a bot net converted to fast flux, it's likely that the bot net will be around for a long while," Ullrich said.

With the prospect of having to track down each infected PC, rather than a single key computer, security experts concerned about Internet safety should focus on stopping the initial spread of bot software, he added.

"You have to prevent it, because once you are infected, it's game over," Ullrich said.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.