Cybercrime is in a state of flux
Date: March 29, 2008Source: Guardian.co.uk
By:
In the recently released internet thriller Untraceable, starring Diane Lane, a criminal uses advanced technology to ensure that his own macabre website remains "untraceable" to FBI agents trying to close him down. Cybercriminals in the real world have their own version, "fast flux", to hide the location of phishing and spamming sites and illegal malware.
The technique was first recognised in March 2007 by security companies monitoring criminal botnets like Storm and Nugache. By January, it had become a standard weapon of choice for phishers and spammers. Robert McCardle, from security firm Trend Micro, says: "Fast flux is one of the biggest tools being used by criminal botnets today. They are definitely on the rise, and make it even more difficult for web users to be protected."
Rise of the botnets
One of the earliest reported sightings was in April 2006, when Brian Eckman, security analyst at the University of Minnesota, was monitoring a botnet later called Nugache. The basic weakness of botnets or "robot networks" is that they can be easily detected. Botnets are built up by creating a herd of infected PCs or "bots" which take orders from a single Command and Control (C&C) server at the top. When the C&C server breaks cover to give orders it can be detected and disabled, and all the bots beneath it no longer function.
But Eckman noticed that the Nugache botnet was spreading peer-to-peer via AOL's instant messenger, using encrypted code as the Command and Control mechanism. This meant it was "headless" and far harder to detect. James Blessing, chair of the broadband group at the UK Internet Service Providers' Association (ISPA), says: "To an investigator [the bots] look like a P2P file-sharing arrangement. There is no head to cut off. They just sit there waiting for instructions."
Fast flux techniques were to evolve still further, Blessing says. Early on, the Nugache bot could be detected because it would connect to exactly 22 other static IP addresses. "Now they change the IP addresses they use frequently and use encrypted code."
David Dittrich, one of the top US botnet researchers at Washington University, believes the use of fast flux evasion could make botnets like Nugache unstoppable. "The shape and size of the botnet was changing almost constantly. The bots were communicating with each other over an encrypted channel, making it all but impossible to listen in on conversations."
Fast flux networks give attackers some key advantages over the older methods of running phishing and spamming sites. In the past, a phishing site would be linked to a single domain. A phisher would register a fake bank site - say, thefakenatwestbank.com; the site must reside on a machine on the internet. But once that machine is spotted (from the domain name system or "DNS" records passed around the net, which translate, say, thefakenatwestbank.com into its IP address, say 1.255.24.16) it will be shut down.
Fast flux keeps changing the DNS records (on the orders of one of the machines on the botnet) perhaps every three minutes, thus changing the machine on which the phishing or spam site is hosted. Every machine on the botnet hosts the same site, but trying to shut it down means serially shutting down every single machine on the botnet. This constant "flux" means the botnet's C&C server can't be found, as well as adding a vast new headache to those trying to stop phishing or shut down spammers - who need their sites to stay online to profit.
Guillaume Lovet, head of the Threat Response Team at Fortinet, thinks fast flux is growing, especially among phishers and spammers. "They use these fast flux services to host phishing sites, money-mule recruitment sites, spammed sites, because they appreciate the degree of survivability and availability that fast flux adds to their servers."
Robert McArdle, AV Specialist at Trendlabs EMEA, agrees that fast flux is a growing problem. "Normally the DNS servers will be hosted on networks that are infamous for being difficult to shut down, such as the networks offered by the Russian Business Network. In the past we had only one malicious webserver to clean up before the threat would be neutralised, now we need to shut down thousands - most of which are home PCs."
In February 2008, the Storm botnet used fast flux techniques in a phishing attack on leading UK banks Barclays and Halifax. According to the recent RSA Anti-Fraud Command Centre survey, UK financial institutions accounted for 15% of all banking brands targeted in the world. The Storm botnet is to blame for this newfound popularity for targeting UK banks.
Policies in flux
One solution proposed to the fast flux threat is to introduce a policy that would shut down a site across the net, rather than on the servers of a particular internet service provider (ISP) - a suggestion of the Anti-Phishing Working Group. Guillame Lovet likes it: "A successful action at the malicious server name registrar level would still effectively cut access to the malicious server."
The Internet Corporation for Assigned Names and Numbers, ICANN, recently came up with its own recommendations for combatting fast flux hosting (tinyurl.com/ywnj8s). They include proposals that registrars uniformly authenticate any requests for configuration changes to names servers and a minimum "time-to-live" threshold for a name server record: making it obligatory to keep pointing to one machine for at least, say, 30 minutes, could slow down fast flux networks.
The most alarming aspect of fast flux is how it might help botnets evade detection in a military or political attack. Dittrich says: "The attacks on Estonian websites were relatively easy to identify and block in a matter of days. Imagine if an adversary was able to control enough computers to use a few thousand here, a few thousand there, for several weeks and stay ahead of their target's defenses because it is harder to find and stop the attacking computers. They would have a potent weapon. More subtle attacks could be used for untraceable espionage and fraud, producing a huge economic impact."
Add comment
Email to a Friend
