Original URL: https://www.theregister.com/2007/07/11/fast_flux_botnet/
Fast flux foils botnet takedown
Many-headed foe hard to combat
Posted in Channel, 11th July 2007 10:46 GMT
Network security analyst Lawrence Baldwin has helped take down his share of bot nets, but he worries that those days may largely be over.
Traditional bot nets have used Internet relay chat (IRC) servers to control each of the compromised PCs, or bots, but the central IRC server is also a weakness, giving defenders a single server to target and take down. An increasingly popular technique, known as fast-flux domain name service (DNS), allows bot nets to use a multitude of servers to hide a key host or to create a highly-available control network. The result: No single point of weakness on which defenders can focus their efforts.
Last month, two significant online threats - the Storm Worm and a recent MySpace web virus - became the latest malicious programs to incorporate fast-flux hosting into their infrastructure. A recent Storm Worm infection, for example, connected to a bot net that had more than 2,000 redundant hosts spread amongst 384 providers in more than 50 countries, said analyst Baldwin, who is the chief forensics officer for myNetWatchman.com.
"That is what you would have to take down in order to shut down the bot net," he said. "It's already ridiculous trying to get an IRC command-and-control server taken down. Now, we are talking about a bot net, that in order to disable it, you have to take down thousands of hosts."
The change in tactics is bad news for defenders. Compromised PCs controlled by attackers - alternately referred to as bots or zombies - are increasingly being used in a variety of cybercrimes.
In late April and early May, networks of zombie PCs were used to attack the web sites and infrastructure of the government in the Northern European country of Estonia. In June, the FBI announced that the agency had identified more than a million compromised PCs infected by bot software.
Bot-net controllers, also known as bot masters, typically search such systems for financial information and use stealthy keylogging software to record usernames and passwords. The systems are also frequently used to overwhelm corporate networks with garbage data in denial-of-service attacks or send spam advertising penny stocks, fake pharmaceuticals or job scams. At any given time, there are 1.5 million different zombie computers sending spam, according to security firm Secure Computing, which estimates that 50 million computers are currently compromised with bot software.
Fast-flux bot nets use the Internet's look-up system for domain names against defenders. With a typical domain, the IP address associated with the domain does not change often, if at all. Fast-flux DNS uses a large number of servers and a fast-changing domain record to turn shutdown attempts into a game of whack-a-mole. A related technique, known as rock phishing, uses a large number of proxies to hide the location of a smaller number of critical servers. The computers typically protected by these methods include the command and control servers for bot nets, phishing sites, caches of stolen data, and sites that push malicious code out to other compromised systems.
"Most of us have heard of bulletproof web hosting - well, this is just a bulletproof bot net," Baldwin said.
Bot programmers have borrowed the technique from spammers. Spam networks have used fast-flux DNS to hide mail servers for several years, and during the late 1990s, when many users still connected to the Internet via dial-up modems, spammers used a variant of fast-flux DNS to point compromised PCs to currently available download servers, said Tom Shaw, the chief engineer for the Okie Island Trading Company, a small aerospace software contractor. Shaw has investigated a number of bot nets as part of his job.
"If you infected enough machines in the dial-up world, you could have a constant presence in the online world, even those these machines were popping on and off," he said.
During one investigation for the Okie Island Trading Company in May, Shaw ran into a fast-flux bot net linked to a phishing site that mimicked a North Carolina bank.
A simple lookup on the phishing site's domain name - from China's address space - immediately turned up five different IP addresses. Rather than deal with shutting down a single server, Shaw now had to deal with five different computers, each likely owned by an unwitting end user infected with bot software. Yet, the attacker didn't stop at five: When Shaw rechecked the domain name six minutes later, three of the addresses had changed. Eventually, tens, or even hundreds, of Internet addresses would rotate through the name server.
"It's like a hydra, with all these heads," Shaw said. "The only way to kill it is to convince the registrar to shut down the domain."
Yet, registrars and Internet service providers are rarely eager to go after bot-infected customers. Shutting down an Internet address or a domain name could mean angering a legitimate customer and would likely lead to expensive support calls. It's no wonder that ISPs and registrars are hesitant to take down potentially infected machines, said Adam Waters, chief operating officer for Support Intelligence, which provides customers security monitoring services.
"When you call them up, you are asking them to take their customers offline," Waters said in a recent interview. "Any business that you ask to do that, well, they are going to be gun shy."
Earlier this year, Support Intelligence found a number of zombie computers that appeared to be located inside the networks of major corporations. When the company tried to contact the corporations involved, few returned the calls. So the security-monitoring firm started highlighting several companies on its blog - a move that brought quicker responses.
Getting registrars to take down domain names is even more difficult, however. And even if successful, repeating that success often enough to fully take down a bot net with distributed DNS is almost impossible, Waters said.
"Fast flux is not about the bad guys hiding where they are," he said. "They are in your face and saying, 'Come take us out.' And you can't."
Top-level domain name registrars - the arbiters of .com, .net, .org and the country-specific domains - could solve the problem by refusing to allow fast-changing domains or by making the takedown process for domains easier. However, making the use of such power routine would worry many people, said Gadi Evron, a bot-net expert and security evangelist for Beyond Security.
"Even if you enable some sort of control at the top-level domain, (you have to ask) do we really want to give them the authority to do that?" Evron said in a recent interview. "I'm all for it, because we have no controls in place to mitigate what is being abused, not to mention, prevent it all together."
Until takedown through the registrars become easier, defenders will have to resign themselves to increasingly difficult-to-disable bot nets, said Johannes Ullrich, chief technology officer for the SANS Internet Storm Center. In the past, only a third of bot nets lasted more than 24 hours. By design, fast-flux bot nets last much longer and, just by their ability to outlive IRC-based bot nets, will likely soon make up the majority of attack networks on the Internet.
"There may not be all that many more conversions to fast-flux DNS, but once we see a bot net converted to fast flux, it's likely that the bot net will be around for a long while," Ullrich said.
With the prospect of having to track down each infected PC, rather than a single key computer, security experts concerned about Internet safety should focus on stopping the initial spread of bot software, he added.
"You have to prevent it, because once you are infected, it's game over," Ullrich said.
This article originally appeared in Security Focus.
Copyright © 2007, SecurityFocus