Feeds

Fast flux foils botnet takedown

Many-headed foe hard to combat

Choosing a cloud hosting partner with confidence

During one investigation for the Okie Island Trading Company in May, Shaw ran into a fast-flux bot net linked to a phishing site that mimicked a North Carolina bank.

A simple lookup on the phishing site's domain name - from China's address space - immediately turned up five different IP addresses. Rather than deal with shutting down a single server, Shaw now had to deal with five different computers, each likely owned by an unwitting end user infected with bot software. Yet, the attacker didn't stop at five: When Shaw rechecked the domain name six minutes later, three of the addresses had changed. Eventually, tens, or even hundreds, of Internet addresses would rotate through the name server.

"It's like a hydra, with all these heads," Shaw said. "The only way to kill it is to convince the registrar to shut down the domain."

Yet, registrars and Internet service providers are rarely eager to go after bot-infected customers. Shutting down an Internet address or a domain name could mean angering a legitimate customer and would likely lead to expensive support calls. It's no wonder that ISPs and registrars are hesitant to take down potentially infected machines, said Adam Waters, chief operating officer for Support Intelligence, which provides customers security monitoring services.

"When you call them up, you are asking them to take their customers offline," Waters said in a recent interview. "Any business that you ask to do that, well, they are going to be gun shy."

Earlier this year, Support Intelligence found a number of zombie computers that appeared to be located inside the networks of major corporations. When the company tried to contact the corporations involved, few returned the calls. So the security-monitoring firm started highlighting several companies on its blog - a move that brought quicker responses.

Getting registrars to take down domain names is even more difficult, however. And even if successful, repeating that success often enough to fully take down a bot net with distributed DNS is almost impossible, Waters said.

"Fast flux is not about the bad guys hiding where they are," he said. "They are in your face and saying, 'Come take us out.' And you can't."

Top-level domain name registrars - the arbiters of .com, .net, .org and the country-specific domains - could solve the problem by refusing to allow fast-changing domains or by making the takedown process for domains easier. However, making the use of such power routine would worry many people, said Gadi Evron, a bot-net expert and security evangelist for Beyond Security.

"Even if you enable some sort of control at the top-level domain, (you have to ask) do we really want to give them the authority to do that?" Evron said in a recent interview. "I'm all for it, because we have no controls in place to mitigate what is being abused, not to mention, prevent it all together."

Until takedown through the registrars become easier, defenders will have to resign themselves to increasingly difficult-to-disable bot nets, said Johannes Ullrich, chief technology officer for the SANS Internet Storm Center. In the past, only a third of bot nets lasted more than 24 hours. By design, fast-flux bot nets last much longer and, just by their ability to outlive IRC-based bot nets, will likely soon make up the majority of attack networks on the Internet.

"There may not be all that many more conversions to fast-flux DNS, but once we see a bot net converted to fast flux, it's likely that the bot net will be around for a long while," Ullrich said.

With the prospect of having to track down each infected PC, rather than a single key computer, security experts concerned about Internet safety should focus on stopping the initial spread of bot software, he added.

"You have to prevent it, because once you are infected, it's game over," Ullrich said.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Choosing a cloud hosting partner with confidence

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.