«FAST-FLUX problem & domains registrars» Pavel Khramtsov Slovenia-2009 The centre of registration of domains

RU-CENTER -  Spoofing – DNS server`s answer substitution (solution – DNSSEC).  Confiker – botnet creator (solution – preventive bulk registration)  Fast-flux – dynamic change of the address resource record – name/address link(solution – UNKNOUN!!!). DNS – the most popular themes (threads)

RU-CENTER - Fast-Flux: term definition  “Fast flux” refers to rapid and repeated changes to an Internet host (A) and/or name server (NS) resource record in a DNS zone, which have the effect of rapidly changing the location (IP address) to which the domain name of an A or NS resolves.  Fast flux attack networks are robust, resource obfuscating service delivery infrastructures. Such infrastructures make it difficult for system administrators and law enforcement agents to shut down active scams and identify the criminals operating them.

RU-CENTER - DNS - server 1. Site.ru A ? 2. Site.ru A HTTP – server ( ) User 3. GET HTTP/1.1http://site.ru Host: site.ru Ok… DNS & Web

RU-CENTER - Cache DNS - server 1. Site.ru A ? 8. Site.ru A HTTP – server ( ) User 9. GET HTTP/1.1 Host: site.ru Ok… DNS & Web in detail 2. Site.ru A ? 3..ru NS ns2.ripn.net ROOT 4. Site.ru A ? 5..site.ru NS n1.site.ru Ns2.ripn.net 6. Site.ru A ? 7. Site.ru TTL A Ns1.site.ru

RU-CENTER - центр регистрации доменов 6 DNS - server 1. Site.ru A ? 2. Site.ru A x User 3. GET HTTP/1.1 Host: site.ru Ok… HTTP – reverse - proxy - сервер … Reverse proxy using Source server

RU-CENTER - центр регистрации доменов 7 Cache DNS -server 2. Site.ru A x y z … Users 3. GET HTTP/1.1 Host: site.ru Ok… HTTP – reverse - proxy - сервер x y z … 1. Site.ru A ? Reverse proxy using & botnets Hidden content server Botnet It is a small TTL that permits fast A records changing A set of the hosts routed throw varied AS

RU-CENTER - центр регистрации доменов 8  multiple IPs per NS spanning multiple ASNs,  frequent NS changes,  in-addrs.arpa or IPs lying within consumer broadband allocation blocks,  domain name age,  poor quality WHOIS,  determination that the nginx proxy is running on the addressed machine: nginx is commonly used to hide/proxy illegal web servers,  the domain name is one of possibly many domain names under the name of a registrant whose domain administration account has been compromised, and the attacker has altered domain name information without authorization. Fast-flux “fingerprints”

RU-CENTER - центр регистрации доменов 9 Top-10 Botnet countries ( - 19/04/2009) RankCountry# of botsin % 1 Russian Federation % 2United States % 3Germany % 4Israel7608 5% 5Korea4665 3% 6Spain4330 3% 7United Kingdom3689 3% 8Italy3396 2% 9France3122 2% 10Romania2830 2% -other %

RU-CENTER - центр регистрации доменов 10 Russian AS & bots ( - 19/04/2009) RankAS numberAS name# of bots CORBINA-AS Corbina Telecom 10' ASN-SPBNIT OJSC North-West Telecom Autonomous System 3' CNT-AS CNT Autonomous System 3' DINET-AS Digital Network JSC TRCODINTSOVO-AS TRC Odintsovo TI-AS NetByNet Holding ISKRATELECOM-AS Iskratelecom Autonomous System NMTS-AS OJSC VolgaTelecom, Nizhny Novgorod USI Uralsviazinform AROMA-LESK-AS Aroma Lesk Ltd. 352

RU-CENTER - центр регистрации доменов 11 ccTLD & Bots RankZoneFast-fluxDomainsFast-flux domains per SU ,55 2.CN ,17 3.BZ ,22 4.COM ,15 5.RU ,01 ( ICANN WG report , Source: Arbor, 2008)

RU-CENTER - центр регистрации доменов 12  Select all distinct domain names from the log of the DNS-server. It`d be better to take log of an authoritative server of the zone.  Test this list against DNS to obtain TTL & IP- address for each domain name few times (100 times for example).  Focus on the names with TTL < 1000 & multiple Ips  Take away from the list Google, Yandex, … Our research: method Then…

RU-CENTER - центр регистрации доменов 13  We received Geography and AS distribution for each domain from the list.  We received intersection with the providers access pools for each Domain. Our research: method It is high probability that “fast-flux” domain has Geographic distribution & AS distribution of its IPs set and belongs to the provider`s access pool.

RU-CENTER - Our research: results Summary results: DescriptionValue Number of the domains with TTL < 1000 & multiple IPs1633 Number of the second level domains with TTL < 1000 & multiple IPs522 Number of the nnn.ru domains with TTL < 1000 & multiple IPs312 Number of the domain names pointing to the end user access pools including: - Geographic Distribution - AS Distribution

RU-CENTER - Our research: results Top-5 domains: DomainQueries ns6.b6f.ru Ns1.ut9.ru (Zimbra server) ns2.Ew0.ru (Zimbra server) NS3.wAntdrOOl.ru Ns1.wEbshopmAG.ru96833 Another tipical name: wnacsspa1j4i.odnoklassniki.x8m.ru.

RU-CENTER - Our research: results Top-5 Countries: CountryDomains Germany350 France349 Poland40 Netherland34 Taiwan32

RU-CENTER - Our research: results Russian AS names & end user access pools: AS nameDomains AGAVA 347 Unknown 1 INAR-VOLOGDA-AS 1 RINET-AS 1

RU-CENTER - Our research: results Registrars & end user access pools: Russian registrar (dif.Regions)Domains NAUNET-REG-RIPN 98 REGRU-REG-RIPN 102 REGTIME-REG-RIPN 183 RIPN-REG-RIPN 1

RU-CENTER - Conclusions 1.TTL & multiple IPs are enough for crude estimation 2.Domain names IPs & und user access pool intersection gives us more precious detection 3.Geographic & AS improve detection

RU-CENTER - Вопросы?