FORENSICS TOOLS||NETWORK TRAFFIC ANALYSIS||TEST DOMAIN FLUX
In 2007, security researchers identified a new technique used by the infamous
Storm botnet (Higgins, 2007). The technique, named fast-flux, used domain
name service (DNS) records to hide the command and control servers that
controlled the Storm botnet. DNS records typically translate a domain name to
an IP address. When a DNS server returns a result, it also specifies the TTL that
the IP address remains valid for before the host should check again.
The attackers behind the Storm botnet changed the DNS records for the
command-and-control server rather frequently. In fact, they used 2,000 redundant
hosts spread amongst 384 providers in more than 50 countries (Lemos, 2007).
The attackers swapped the IP addresses for the command-and-control server frequently
and ensured the DNS results returned with a very short TTL. This fast-flux
of IP addresses made it difficult for security researchers to identify the commandand-
control servers for the botnet and even more difficult to take the servers offline.
While fast-flux proved difficult in the takedown of the Storm botnet, a similar
technique used the following year aided in the infection of seven million
computers in over two hundred countries (Binde et al., 2011). Conficker, the
most successful computer worm to date, spread by attacking a vulnerability
in the Windows Service Message Block (SMB) protocol. Once infected,
the vulnerable machines contacted a command-and-control server for
further instructions. Identifying and preventing communication with the
command-and-control server proved absolutely necessary for those involved
with stopping the attack. However, Conficker generated different domain
names every three hours, using the current date and time at UTC. For the
third iteration of Conficker, this meant 50,000 domains were generated
every three hours. Attackers registered only a handful of these domains to
actual IP addresses for the command-and-control servers. This made intercepting
and preventing traffic with the command-and-control server very
difficult. Because the technique rotated domain names, researchers named
it domain-flux.
In the following section, we will write some Python scripts to detect fast-flux
and domain-flux in the wild to identify attacks.