Thread-topic: DNS recursive attacks, spamvrtised domains, phishing, botnet C&C's and you
------------------
Message: 3
Date: Fri, 17 Feb 2006 14:56:19 +0200
From: Gadi Evron <ge@xxxxxxxxxxxx>
Subject: [Dailydave] Looking behind the smoke screen of the Internet
and Internationa Infrastructure: DNS recursive attacks,
spamvrtised
domains, phishing, botnet C&C's and you
To: dailydave <dailydave@xxxxxxxxxxxxxxxxxxxxx>
Message-ID: <43F5C7F3.5000007@xxxxxxxxxxxx>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
[X-posted]
This text is meant for two (main) purposes:
1. Updating the community about recent threats.
2. Showing the community some suggestions of what can be done.
In the recent weeks many people (including on different public ops
communities such as NANOG) have noticed DDoS attacks going on, which
appear to be abusing recursive DNS servers.
A couple of documents on the subject:
The attacks generally seem the same as always. Nothing new here. Why the
big buzz than? (so far these have been kept "quiet" on several
communities even if it is in plain sight and people speak of it openly).
The buzz may be about the packet size/resulting fragmentation this time
around, actual attacks seen in the wild on a wide scale, etc.
Regardless, nothing new. Recursive is bad. Don't do it. :)
For those of us too busy to read the documents linked to above, imagine
an ICMP echo attack from spoofed sources that get back the replies, only
in DNS... this is not very technically correct but it will do.
Ignoring the DDoS for a second, in the last year, completely unrelated,
in the anti virus world we see (and don't really connect the dots) more
and more Trojan horses (i.e. bots) which use fast-changing-IP-addresses
hosts/domains. Changing IP addresses or even name servers very often.
These are now called "Fast-Flux" domains.
Not connecting the dots as in the samples one sees the DNS RR's, not
that they keep changing.
Fast-Flux is actually a term which was coined in the anti spam fighters
world, completely unrelated to the anti virus world. As these hosts are
used to spamvertise from, or these name servers are used to host such
bad domains, this is obviously something bad (although some Fast-Flux
issues are legit, most aren't).
Some of these domains, following certain patterns, are used in Trojan
horses (maybe we should call them zombies this time) to coordinate. I.e.
the C&C (Command and Control, also known as C2) servers where the
different Trojans (bots) bots are controlled from.
These patterns, such as those used by the (now old) Bobax Trojan (worm!)
often utilize a domain pattern which needs to be ascertained if one
wants to control these C&C's as it changed with, for example, the
time-stamp. (old IRC trick from the GirlBots Trojan horses, with
differentiating channel names)
These can be 3LD's or actually domains, i.e.:
jusdbgvosibs.dynamicdnsprovider.com
msfgsbzxcffh.dynamicdnsprovider.com
vnyjdcjsxngx.dynamicdnsprovider.com
fsbiuabf.com
afouabfo.com
arlkehnm.com
The samples would connect to these based on the algorithm, while these
will be registered by the bad guys.
In the recent attacks the specific name servers which are vulnerable are
used while the domains are being spamvertised and then switched back to
a different NS.
This may indeed be the DNS activity seen, or it may be unrelated. I
don't believe in coincidences though.
The DDoS (which may be a direct or unrelated result of spamvertising or
botnet control over DNS) may be a smoke screen for what's really going
on, or it may be what it seems, just DDoS. As the bot controllers do
both spam and DDoS, I see no reason why they wouldn't use this
technology for both purposes (or other purposes yet to be seen).
They (the bad guys) may have even just noticed it in the wild, used by
other bad guys or they shared the techniques (they have quite a lot of
cooperation going). While the good guys weren't sharing
information/cooperating and thus not noticing it happening for a long
time now.
If they (the good guys) do notice "it", for example, the DDoS, then they
don't notice the connection between different industries and fields.
-opinion- Thinking a vulnerability or error will not be
exploited/mistakenly triggered at some point in time just because it is
left alone for a while is insane. Even if as the saying go, we won't
attribute malicious intend to what is likely stupidity - any mistake
which can happen, will happen. Major parts of the US power grid going
down every few years proved that much.-/opinion-
Fast-Flux hosts have also been used in Phishing for over a year now
(before that they were indeed in the wild, but mostly in proof of
concept attempts).
Phishing in its original form of receiving a mail message and going to a
site is going to be with us 10 years from now (much like 419's are still
with us today), but it is slowly decreasing in volume for some time now.
Phishing in general however, is in fact increasing with millions on
millions of USD lost every month. Quite a bit of ROI for the Russian Mob
and friends from Brazil, Eastern Europe, Nigeria, other hot-spots and
the rest of the world, don't you think?
The bad guys utilize Trojan horses (sorry, bots) more and more now for
this activity, rather than the old bulk emailing techniques (even using
... zombies).
The Trojan horse (sorry, worm) would connect to the DNS RR, which will
change IP addresses and/OR name servers quite often, and thus while
thousands, hundreds of thousands and all the way to millions of Trojan
horses (zombies!!!) send out Phishing emails, the actual sites moves
constantly (between every 10 minutes to once a day). This makes
reporting these sites and taking them off the air increasingly
difficult.
That is also why anti virus companies become critical to the fight to
keep the Internet alive, as while network operators can follow network
traffic, the anti virus researchers and reverse engineers actually see
what the Trojan horse does and how.
Dynamic DNS providers (most of whom are good.. amazing people) have seen
this done with 3LD's as botnet C&C servers for a few years now. Use of
cryptographically strong domain names (with whatever algorithm used) is
newer, but not that new.
What am I trying to say here?
All these activities are related, and therefore better coordination
needs to be done much like we do on the DA and MWP groups,
cross-industry and open-minded. R&D to back up operations is critical,
as what's good for today may be harmful tomorrow (killing C&C's as an
example).
The industry needs to get off its high tree and see the light. There are
good people who never heard about BGP but eat Trojans (sounds bad) for
breakfast, and others need to see that just because some don't know how
to read binary code doesn't mean they are not amazingly skilled and
clued with how the network runs.
This is not my research alone. I can only take credit for seeing the
macro image and helping to connect the dots, as well as facilitate
cooperation across our industry. Still, as much as many of this needs to
remain quiet and done in secret-hand-shake clubs, a lot of this needs to
get public and get public attention.
Over-compartmentalizing and over-secrecy hurts us too, not just the US
military. If we deal in secret only with what needs to be dealt in
secret, people may actually keep that secret better, and more resources
can be applied to deal with it.
Some things are handled better when they are public, as obviously the
bad guys already know about them and share them quite regularly. "Like
candy" when it comes to malware samples, as an example.
Some solutions to think about:
- Help facilitate better cooperation.
- Help facilitate better coordination.
- Join a mitigation group, do something.
- Join a research group, find solutions that won't just kill the current
- problem and make it far worse 2 years down the road (terrorism, spam,
botnets, phishing).
- Work with others outside your club, you may learn something.
- Stop ignoring problems until they become yesterday's problems.
Some intermediate solutions:
- Run a clean computer. Secure your machine.
- Run a clean service provider, secure your network and answer abuse
reports.
- Cooperate and share information.
- Cooperate with law enforcement, as economics such as the ROI the bad
guys see can only be beaten with changing the cost-benefit/risk-gain
equation.
Some immediate solutions:
- Block outgoing port 25 on dynamic ranges if it is right for your
organization ("don't be the Internet's firewall").
- Make sure your DNS servers don't allow recursive requests.
I recently shared with Paul Vixie an idea for a structure of an
operational group for DNS. Paul Vixie and the DNS folks are taking care
of their end with the DNS infrastructure where they can.
DNS in general (not the infrastructure) has been neglected for a long
time.
Are you taking care of your issues? Are you as responsible as these
guys?
A lot more can be done, a lot more can be suggested. There are many
examples of people doing amazing work. NSP-SEC, DA, MWP and many others.
These ideas should get us started on the next level of taking care of
business.
Want to be involved? Get involved. See a threat? Share it. Think I am
wrong? Bring up your own idea and follow through, don't just criticize
others or try and stop them because you've grown warm and cozy in your
spot in this world or for whatever other reason or jealousies you may
have, as eventually they will circumvent you and work without you.
-opinion-One example for this is the anti virus industry and their
naming conventions (hopefully to change with CME from Mitre). Another is
the US Government thinking they can control the Internet and China
showing them that if they won't let them in, they will create their own
systems. That's just a hint of things to come, with alternate roots as
just one side of the problem.
The Internet is an "International Infrastructure" and these power
struggles are self-defeating.-/opinion-
Feel free to ping me if you'd like to know what information sharing
effort is going on in your area as well as involving your area with
others (an effort which will actually allow you to join and help), as
the fault is not only yours but also ours.
-opinion-Our fault, us, the people who run these communities and global
efforts, for being over-secretive on issues that should be public and
thus also neglecting the issues that should really remain under some
sort of secrecy, plus preventing you from defending yourself.
Us, for being snobbish dolts and us, for thinking we invented the wheel,
not to mention that we know everything or some of us who try to keep
their spots of power and/or status by keeping new blood out (AV industry
especially, the net-ops community is not alone in the sin of hubris).
It's time to wake up. The Internet is not about to die tomorrow and
there is a lot of good effort from a lot of good people going around.
Amazing even, but it is time to wake up and move, as we are losing the
battle and the eventual war.
Cyber-crime is real crime, only using the net. Cyber-terrorism will be
here one day. If we can't handle what we have on our plate today or
worse, think we are OK, how will we handle it when it is here?
There is a lot yet to be said, a lot which is not 100% accurate and a
lot that needs to be done as well as already being done. It's not enough
and it can't all be covered in one write-up.
This text can be found here:
Future updates can be found here:
Thank you.
Gadi Evron.
--
"Out of the box is where I live".
-- Cara "Starbuck" Thrace, Battlestar Galactica.
