Fast flux foils botnet takedown
Many-headed foe hard to combat
During one investigation for the Okie Island Trading Company in May, Shaw ran into a fast-flux bot net linked to a phishing site that mimicked a North Carolina bank.
A simple lookup on the phishing site's domain name - from China's address space - immediately turned up five different IP addresses. Rather than deal with shutting down a single server, Shaw now had to deal with five different computers, each likely owned by an unwitting end user infected with bot software. Yet, the attacker didn't stop at five: When Shaw rechecked the domain name six minutes later, three of the addresses had changed. Eventually, tens, or even hundreds, of Internet addresses would rotate through the name server.
"It's like a hydra, with all these heads," Shaw said. "The only way to kill it is to convince the registrar to shut down the domain."
Yet, registrars and Internet service providers are rarely eager to go after bot-infected customers. Shutting down an Internet address or a domain name could mean angering a legitimate customer and would likely lead to expensive support calls. It's no wonder that ISPs and registrars are hesitant to take down potentially infected machines, said Adam Waters, chief operating officer for Support Intelligence, which provides customers security monitoring services.
"When you call them up, you are asking them to take their customers offline," Waters said in a recent interview. "Any business that you ask to do that, well, they are going to be gun shy."
Earlier this year, Support Intelligence found a number of zombie computers that appeared to be located inside the networks of major corporations. When the company tried to contact the corporations involved, few returned the calls. So the security-monitoring firm started highlighting several companies on its blog - a move that brought quicker responses.
Getting registrars to take down domain names is even more difficult, however. And even if successful, repeating that success often enough to fully take down a bot net with distributed DNS is almost impossible, Waters said.
"Fast flux is not about the bad guys hiding where they are," he said. "They are in your face and saying, 'Come take us out.' And you can't."
Top-level domain name registrars - the arbiters of .com, .net, .org and the country-specific domains - could solve the problem by refusing to allow fast-changing domains or by making the takedown process for domains easier. However, making the use of such power routine would worry many people, said Gadi Evron, a bot-net expert and security evangelist for Beyond Security.
"Even if you enable some sort of control at the top-level domain, (you have to ask) do we really want to give them the authority to do that?" Evron said in a recent interview. "I'm all for it, because we have no controls in place to mitigate what is being abused, not to mention, prevent it all together."
Until takedown through the registrars become easier, defenders will have to resign themselves to increasingly difficult-to-disable bot nets, said Johannes Ullrich, chief technology officer for the SANS Internet Storm Center. In the past, only a third of bot nets lasted more than 24 hours. By design, fast-flux bot nets last much longer and, just by their ability to outlive IRC-based bot nets, will likely soon make up the majority of attack networks on the Internet.
"There may not be all that many more conversions to fast-flux DNS, but once we see a bot net converted to fast flux, it's likely that the bot net will be around for a long while," Ullrich said.
With the prospect of having to track down each infected PC, rather than a single key computer, security experts concerned about Internet safety should focus on stopping the initial spread of bot software, he added.
"You have to prevent it, because once you are infected, it's game over," Ullrich said.
This article originally appeared in Security Focus.
Copyright © 2007, SecurityFocus