Slashdot Mirror
Cybercriminals Building New, Stealthier Networks
ancientribe writes "Cybercriminals are adopting a new method of hiding and sustaining their malicious Websites and botnet infrastructures so they'll be harder to detect, called "fast-flux," according to an article in Dark Reading. Criminal organizations behind two infamous malware families — Warezov/Stration and Storm — in the past few months have separately moved their infrastructures to so-called fast-flux service networks. The article says bad guys like fast-flux not only because it keeps them up and running, but also because it's more efficient than traditional methods of infecting victims' machines." I'm not exactly sure why this is new/different than the more well known open relay proxy networks.
The bit about blocking TCP port 80 is troubling. I run a small web-site for learning purposes and to share info with family and friends. I don't especially like the possibility of having to ask or pay extra to have port 80 opened on my end.
We all know what to do, but we don't know how to get re-elected once we have done it
These criminals are giving a "smarter" * use for the enormous potential that these hundred thousands of homogeneous (or similar enough) connected machines have than most companies out there does. It is time for 1) Microsoft and its users get their act straight and work on better security for they machines and 2) someone to realize the incredible potential of all this "dark" bandwidth and processing power and give it a good use. Criminals are showing it is possible, all it need is some legitimate application.
* Smart but immoral and illegal. I, for one, don't condone nor endorse their actions, and think they are nothing but vile criminals
translate: Scum of the earth trying to stay 1 step ahead of kings horses & men
News at 11
I will not give in to the terrorists. I will not become fearful.
The essence of the article really boils down to "botnet herders may have the ability to update their DNS info quickly".
/.ers likely knew this already, but I imagine this may be exciting and scary to some suits.
Possibly makes it incrementally harder to track down every last one of the pwned machines, a tad more if your logs store only resolved names but no IP addresses.
Most
In other words, the world did not change much due to this.
-- That grumpy BSD guy - http://bsdly.blogspot.com/
...cuz, really, I shorted out a zombo compy...you dig?
"I'm not exactly sure why this is new/different than the more well known open relay proxy networks."
I am not a networking guru (IANANG, copyright 2007, me, all rights reserved), so I'd appreciate somebody setting me straight on this if necessary.
But I don't really see how blocking port 80 would be an effective way to fight this sort of thing. There's nothing special about port 80 aside from it being the default http port. Unless the victims are typing the URL into their address bar, I don't see any reason the mother ship couldn't have bots listen on another port. I mean, the machine is already owned, so it's not like opening up port 43783 is difficult. And I can't help believing that most - if not all - people going to these sites are clicking links, not typing addresses.
So you close off port 80, and anyone running a legit (well, probably not, given the TOS of most ISPs, but at least not a malicious) web server out of their house/apartment/dorm room can no longer easily direct people to it. Meanwhile, the malicious sites are slowed down by the amount of time it takes some jackass to change one constant in one piece of code.
Unless, of course, there's some other factor I'm unaware of making it more difficult to reach an http host over something other than port 80.
Reality has a conservative bias: it conserves mass, energy, momentum...
Save the song-and-dance about what the word meant in the 70s and accept that language is fluid and the meaning has changed. ...or has it, even?
Crime is defined by the law, not by what you think the laws should be -- and by that standard, even most of the "white hat" hackers are "cybercriminals". So just call them hackers, please. Don't use feeble euphemisms. Canute couldn't hold back the tide and you can't change the meaning of words through minority boycotting.
Has a lot more detail: http://www.honeynet.org/papers/ff/fast-flux.html
Child porn, illegal websites, etc...
Yawn. How many techies didn't see this coming?
But it will make a great coffee-table conversation topic...
Them: So you don't run Windows? Why not?
Me: Because I don't like supporting child porn.
And then the conversation will turn to how criminals use vulnerabilities in Windows to conduct their illicit affairs.
The society for a thought-free internet welcomes you.
Nothing to see here.
No, seriously. Cybercriminals fast-fluxed my gag and now I've got nuttin'.
If some white guy starts casually using terms like "nigger" you know something useful about them: they're an idiot racist.
The word "hacker" is a similarly useful filter.
Meatspace criminals worry me a lot more.
Last year I had my car, cell phone, debit card (and pin) and checks stolen by a meatspace woman I was trying to help. At least they can't kill you or injure you over the internet!
Oh, and can we at least try for some reading comprehension? That's a perfectly reasonable statement and makes no mention whatsoever of Microsoft, Apple, Google or George Bush.
Faster! Faster! Faster would be better!
The media is very good at taking a word and giving their own spin to it. Thus hacker gets a negative connotation.
Do note that 'hack' has a negative connotation in the media industry. Perhaps those of us in the computer world can link that word to various media 'hacks' that need vocabulary training. We do, after all, know how computer based media works.
I seem to recall a sage commenting that one should "Never argue with an organization that buys ink by the barrel."
Perhaps we should update that with "Never argue with geeks whose home computers would make the world's largest computing array."
How about ISPs try the obvious:
block the DNS for known phishing sites.
e.g. Spam filter raises a warning to an e-mail that invites you to visit manlynessenhancer.biz.
Solution: in ISP's DNS route manlynessenhancer.biz to a warning site that says:
This is known phishing site, we've blocked it for Your protection.
Lone Gunmen crew.
"Hacker" originally referred to axe-wielding cabinetmakers. Words are only symbols, and meanings inevitably change.
"2600: The Hacker Quarterly," "Phrack" and other self-described hacker-oriented zines regularly feature articles geared towards illegal systems intrusion and information theft.
"Hackers," the movie starring Academy Award winner Angelina Jolie, is all about hackers and their battle against law enforcement.
"DEF CON: The Hacking Convention" and "Hackers On Planet Earth" have never convened without multiple presentations on activities which when implemented would be against the law. Law enforcement regularly surveils such gatherings.
Bruce Sterling's "The Hacker Crackdown" carries the subtitle "Law and Disorder on the Electronic Frontier," which is self-explanatory.
Any newspaper article of the past 20 years with the word "hacker" in the title will be referring to criminal activity.
The word's changed. It had changed 10 years ago.
-- Lightning of Peoria.
The media is very good at taking a word and giving their own spin to it. Thus hacker gets a negative connotation.
Which is why it's a useful filter. It tells you that the person you're speaking to gets their ideas about computer security from the media.
I find it's a great way to share information with friends if you happen to use IRC as your preferred means of digital communication instead of IM.
Maintain a nonstandard port webserver with a dummy index.html file, dump any files you'd like to share with friends in there, have a little alias script which fills in the blanks with your site address (like "/myweb whatever.jpg") and then let rip.
It's a lot easier to show people what your most recent project is without having to deal with crap like Flickr, MySpace, Facebook, and whatnot. Saves you having to upload everything first to your web host, then have your friends download it, especially when it's just something small like 35kb jpeg or the like (or even something larger, like your most recent composition in mp3 format). A good DSL connection these days can push 80kb/s, which is fast enough to stream a low-fi mp3 to 4 or more people at once.
Additionally, having your own local webserver set up was a tremendous help when I was teaching myself PHP, and later when I was developing some rather tricky websites for subcontract work. Beats having to hit upload in your HTML editor of choice, or having to deal with the lag of working over SFTP, then refresh the web browser after the transfer finishes.
This is assuming you're not completely hardcore and do all of your PHP/HTML/CSS in vi or emacs instead of a more modern code editor (code collapse, color highlighting, and completion is your friend).
The land shall stone them with the bread of his son.
Fast-flux takes advantage of the ability to set extremely low time-to-lives on DNS resource records. The shorter the TTL, the faster changes propagate out through the DNS cache network. This suggests a way of neutering fast-flux: implement a minimum TTL in DNS servers. Since most people depend on their ISP's DNS servers rather than going directly to the roots, this would effectively prevent the fast-flux record changes from propagating as fast as they need to to be effective. If, for example, an ISP put a 30-minute minimum TTL in place, then the A record for a given name would remain fixed for 30 minutes (modulo cache being filled and the record being forced out) regardless of what the fast-flux network did. And since the DNS servers enforcing the minimum typically aren't under the control of either the botnet or the infected machines, there's nothing the botnet operators can do about the situation. As a side-effect, this also cuts the load on the DNS network caused by PHBs who order 60-second TTLs on their records "so customers won't be inconvenience when we change our IP addresses".
Two glitches with the idea:
"Criminals are showing it is possible, all it need is some legitimate application."
Piratebay and P2P is leading the way with move-countermove in an effort to get Linux iso's like Baby, one more time out to the public.
"Me: Because I don't like supporting child porn."
Not running Tor, are we?
Defense is legal, Offense is illegal, and why? "I don't know." THIRD-BASE!
...) are the problem. If someone a/o some country/religion tries to crack your network ... it is a hell of allot more reasonable to go on the offensive and destroy the enemy ... collecting forensics and bits/body data is important to defense (as defined above), but legally can be insubstantial false-trail/trap for debate and for court worthless.
My logic, you need defense to be able to do what you need/want to do (like go on the offense).
Also, you need offense to prevent others from doing what you don't want them to do (like they can't go on offense).
IOW: The real purpose of defensive action is to provide force/operations security, until offensive action is possible.
Intel/CoOps (like chicken "coops") are a defensive actions that disrupt the ability of others to take a successful offensive action, while allowing you to develop effective and successful offensive actions. It all (technology security) confuses an old war monger like me.
Anyway; any/all defense will fail, unless the purpose is "Offense". So; with my way of thinking, the laws/regs/policies for preventing the use of technology (gun, lock, Internet, encryption
If you want to win you must always be on the offense. Offense or Defense will always win a battle, but only offense can win the war.
So; put the criminal crackers out of business with brilliant offense, don't legislate technology out of business with draconian idiotic "defense-only". Defense-only is as dumb as all the ObSec (Obscurity Security) governments and business want to implement. Clear the decks, clear the laws, clear for battle, take the SOBs out, and don't provoke the good public and citizens with further legislative/regs/policies stupidity.
Advice: If you have a Defense-only/ObSec policy get rid of it quick (as legally as possible), If you have a Defense-only/ObSec consultant/service company get rid of it quick (as legally as possible). Always look to solve problems permanently, because always being reactionary is a dogmatic (non-thinking) suicidal tactic. Gut-feelings truthyness (comically) is always fun for the clueless losers.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
As the subject implies, fast-flux networks are not proxies. They HAVE proxies. The basic difference is that a proxy redirects incoming and outgoing traffic through a server or router some where else, thus "spoofing" your IP address. Fast-flux networks certainly use proxies, but there's one big difference; fast-flux networks allow you to host content this way. To host your own website (short of technical mastery) you used to need a static IP address that runs directly to one or more servers, making it very easy to catch you if you use a domain name for illegal purposes and even easier to shut you down. Fast-flux networks allow you to use many IP addresses to host content from one central server or set of servers. The IP's on the front end are disposable and more can be generated quickly. It also provides the web site administrator a proxy level to protect his identity while hosting just like the one Tor proxy provides me while surfing. In other words, the difference between fast-flux networks and proxies is that fast-flux networks can be used to host from one computer to many different IP addresses, in part by using proxies. A proxy just doesn't let you do that. Thanks for reading a rather long post. I'm a student and a paper on fast-flux networks just happened to be distributed where I do research for the summer:)
From the Wikipedia article (sorry about the broken link in the last post, the URL: autolinker failed or something):
> In the computing community, the primary meaning is a complimentary description for a particularly brilliant programmer or technical expert.
In what way is being "a particularly brilliant programmer or technical expert" criminal? Is there some kind of sociological correlation I am unaware of which would lead one to expect that most hackers of this kind would be criminals?
Clear enough now? Hopefully I haven't left any trivial points you can quibble with?
Why not use fast-flux against the botnet itself? If I know that a certain website is being hosted by a rotating array of bots, then I just query the IP address of the website every 30 seconds or so and the spammer will, over time, reveal the IP address of every bot in his network. That's got to be useful somehow, especially if you could work with the ISPs to have them notify the owners of the compromised machines, or block them if necessary (although that kind of cooperation may be a vain hope).
Build a man a fire and he will be warm for a night; set him on fire and he will be warm for the rest of his life.
ALL of these zombies are computers running a Windows OS.
There. I've said it. Why hide the truth?
Are journalist thinking "everyone knows it is Windows that is so vulnerable to mere emails, so there's no use in embarrassing Microsoft"? I don't think so... any more than they "just happened" to get Ferrari laptops for writing good articles about VISTA.
Running with Linux for over 20 years!
I just bought fast-flux.com and fast-flux.net.
any takers?
Collateral damage is caused with defensive and "offensive" actions. In modern warfare defense is always the losing position. We need to start looking at how to identify and terminate the problem ... take the war to the enemy until unconditional surrender.
... for tossing into public places and school grounds. I never blame science, technology, tools, dupes ... for criminal activities, I blame the specific humans/governments for the criminal/provocative actions.
... as the cause, but no one in the USA is really going on tactical and strategic offense (as the mess in Iraq proves) ... all that is done is fear mongering reactionary defense and oppression of science, technology, tools, dupes ....
Putting band-aids/stitches to keep the dirt out and allow healing is defensive, there will always be broken glass and sharp objects available to crackers, phreakers
Today's Terrorist and Cyber/Technology Warfare are very much alike. Most governments and people living in fear of the next big unknown whatever, running around like chickens with their heads cut off and/or reactionary blaming science, technology, tools, dupes
Politics ends with diplomacy, diplomacy ends with Warfare, and reverse. Iraq and Vietnam (for US) will forever be examples of politics mimicking war, never a failure of diplomacy, just defeat of stupid reactionary politics that are frequently greed or faux-pride based.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?