[X-posted]

This text is meant for two (main) purposes: 1. Updating the community about recent threats. 2. Showing the community some suggestions of what can be done.

In the recent weeks many people (including on different public ops communities such as NANOG) have noticed DDoS attacks going on, which appear to be abusing recursive DNS servers.

A couple of documents on the subject: http://www.us-cert.gov/reading_room/DNS-recursion121605.pdf http://cc.uoregon.edu/cnews/winter2006/recursive.htm

The attacks generally seem the same as always. Nothing new here. Why the big buzz than? (so far these have been kept "quiet" on several communities even if it is in plain sight and people speak of it openly).

The buzz may be about the packet size/resulting fragmentation this time around, actual attacks seen in the wild on a wide scale, etc. Regardless, nothing new. Recursive is bad. Don't do it. :)

For those of us too busy to read the documents linked to above, imagine an ICMP echo attack from spoofed sources that get back the replies, only in DNS... this is not very technically correct but it will do.

Ignoring the DDoS for a second, in the last year, completely unrelated, in the anti virus world we see (and don't really connect the dots) more and more Trojan horses (i.e. bots) which use fast-changing-IP-addresses hosts/domains. Changing IP addresses or even name servers very often. These are now called "Fast-Flux" domains.

Not connecting the dots as in the samples one sees the DNS RR's, not that they keep changing.

Fast-Flux is actually a term which was coined in the anti spam fighters world, completely unrelated to the anti virus world. As these hosts are used to spamvertise from, or these name servers are used to host such bad domains, this is obviously something bad (although some Fast-Flux issues are legit, most aren't).

Some of these domains, following certain patterns, are used in Trojan horses (maybe we should call them zombies this time) to coordinate. I.e. the C&C (Command and Control, also known as C2) servers where the different Trojans (bots) bots are controlled from.

These patterns, such as those used by the (now old) Bobax Trojan (worm!) often utilize a domain pattern which needs to be ascertained if one wants to control these C&C's as it changed with, for example, the time-stamp. (old IRC trick from the GirlBots Trojan horses, with differentiating channel names)

These can be 3LD's or actually domains, i.e.: jusdbgvosibs.dynamicdnsprovider.com msfgsbzxcffh.dynamicdnsprovider.com vnyjdcjsxngx.dynamicdnsprovider.com

fsbiuabf.com afouabfo.com arlkehnm.com

The samples would connect to these based on the algorithm, while these will be registered by the bad guys.

In the recent attacks the specific name servers which are vulnerable are used while the domains are being spamvertised and then switched back to a different NS.

This may indeed be the DNS activity seen, or it may be unrelated. I don't believe in coincidences though.

The DDoS (which may be a direct or unrelated result of spamvertising or botnet control over DNS) may be a smoke screen for what's really going on, or it may be what it seems, just DDoS. As the bot controllers do both spam and DDoS, I see no reason why they wouldn't use this technology for both purposes (or other purposes yet to be seen).

They (the bad guys) may have even just noticed it in the wild, used by other bad guys or they shared the techniques (they have quite a lot of cooperation going). While the good guys weren't sharing information/cooperating and thus not noticing it happening for a long time now. If they (the good guys) do notice "it", for example, the DDoS, then they don't notice the connection between different industries and fields.

-opinion- Thinking a vulnerability or error will not be exploited/mistakenly triggered at some point in time just because it is left alone for a while is insane. Even if as the saying go, we won't attribute malicious intend to what is likely stupidity - any mistake which can happen, will happen. Major parts of the US power grid going down every few years proved that much.-/opinion-

Fast-Flux hosts have also been used in Phishing for over a year now (before that they were indeed in the wild, but mostly in proof of concept attempts).

Phishing in its original form of receiving a mail message and going to a site is going to be with us 10 years from now (much like 419's are still with us today), but it is slowly decreasing in volume for some time now.

Phishing in general however, is in fact increasing with millions on millions of USD lost every month. Quite a bit of ROI for the Russian Mob and friends from Brazil, Eastern Europe, Nigeria, other hot-spots and the rest of the world, don't you think?

The bad guys utilize Trojan horses (sorry, bots) more and more now for this activity, rather than the old bulk emailing techniques (even using ... zombies).

The Trojan horse (sorry, worm) would connect to the DNS RR, which will change IP addresses and/OR name servers quite often, and thus while thousands, hundreds of thousands and all the way to millions of Trojan horses (zombies!!!) send out Phishing emails, the actual sites moves constantly (between every 10 minutes to once a day). This makes reporting these sites and taking them off the air increasingly difficult.

That is also why anti virus companies become critical to the fight to keep the Internet alive, as while network operators can follow network traffic, the anti virus researchers and reverse engineers actually see what the Trojan horse does and how.

Dynamic DNS providers (most of whom are good.. amazing people) have seen this done with 3LD's as botnet C&C servers for a few years now. Use of cryptographically strong domain names (with whatever algorithm used) is newer, but not that new.

What am I trying to say here?

All these activities are related, and therefore better coordination needs to be done much like we do on the DA and MWP groups, cross-industry and open-minded. R&D to back up operations is critical, as what's good for today may be harmful tomorrow (killing C&C's as an example).

The industry needs to get off its high tree and see the light. There are good people who never heard about BGP but eat Trojans (sounds bad) for breakfast, and others need to see that just because some don't know how to read binary code doesn't mean they are not amazingly skilled and clued with how the network runs.

This is not my research alone. I can only take credit for seeing the macro image and helping to connect the dots, as well as facilitate cooperation across our industry. Still, as much as many of this needs to remain quiet and done in secret-hand-shake clubs, a lot of this needs to get public and get public attention.

Over-compartmentalizing and over-secrecy hurts us too, not just the US military. If we deal in secret only with what needs to be dealt in secret, people may actually keep that secret better, and more resources can be applied to deal with it. Some things are handled better when they are public, as obviously the bad guys already know about them and share them quite regularly. "Like candy" when it comes to malware samples, as an example.

Some solutions to think about: - Help facilitate better cooperation. - Help facilitate better coordination. - Join a mitigation group, do something. - Join a research group, find solutions that won't just kill the current - problem and make it far worse 2 years down the road (terrorism, spam, botnets, phishing). - Work with others outside your club, you may learn something. - Stop ignoring problems until they become yesterday's problems.

Some intermediate solutions: - Run a clean computer. Secure your machine. - Run a clean service provider, secure your network and answer abuse reports. - Cooperate and share information. - Cooperate with law enforcement, as economics such as the ROI the bad guys see can only be beaten with changing the cost-benefit/risk-gain equation.

Some immediate solutions: - Block outgoing port 25 on dynamic ranges if it is right for your organization ("don't be the Internet's firewall"). - Make sure your DNS servers don't allow recursive requests.

I recently shared with Paul Vixie an idea for a structure of an operational group for DNS. Paul Vixie and the DNS folks are taking care of their end with the DNS infrastructure where they can. DNS in general (not the infrastructure) has been neglected for a long time.

Are you taking care of your issues? Are you as responsible as these guys?

A lot more can be done, a lot more can be suggested. There are many examples of people doing amazing work. NSP-SEC, DA, MWP and many others.

These ideas should get us started on the next level of taking care of business.

Want to be involved? Get involved. See a threat? Share it. Think I am wrong? Bring up your own idea and follow through, don't just criticize others or try and stop them because you've grown warm and cozy in your spot in this world or for whatever other reason or jealousies you may have, as eventually they will circumvent you and work without you.

-opinion-One example for this is the anti virus industry and their naming conventions (hopefully to change with CME from Mitre). Another is the US Government thinking they can control the Internet and China showing them that if they won't let them in, they will create their own systems. That's just a hint of things to come, with alternate roots as just one side of the problem.

The Internet is an "International Infrastructure" and these power struggles are self-defeating.-/opinion-

Feel free to ping me if you'd like to know what information sharing effort is going on in your area as well as involving your area with others (an effort which will actually allow you to join and help), as the fault is not only yours but also ours.

-opinion-Our fault, us, the people who run these communities and global efforts, for being over-secretive on issues that should be public and thus also neglecting the issues that should really remain under some sort of secrecy, plus preventing you from defending yourself.

Us, for being snobbish dolts and us, for thinking we invented the wheel, not to mention that we know everything or some of us who try to keep their spots of power and/or status by keeping new blood out (AV industry especially, the net-ops community is not alone in the sin of hubris).

It's time to wake up. The Internet is not about to die tomorrow and there is a lot of good effort from a lot of good people going around. Amazing even, but it is time to wake up and move, as we are losing the battle and the eventual war.

Cyber-crime is real crime, only using the net. Cyber-terrorism will be here one day. If we can't handle what we have on our plate today or worse, think we are OK, how will we handle it when it is here?

There is a lot yet to be said, a lot which is not 100% accurate and a lot that needs to be done as well as already being done. It's not enough and it can't all be covered in one write-up.

This text can be found here: http://blogs.securiteam.com/index.php/archives/298

Future updates can be found here: http://blogs.securiteam.com/

Thank you.

Gadi Evron.