427 Botnet fm qxd

www.syngress.com
Alternative Botnet C&Cs • Chapter 3
89
427_Botnet_03.qxd 1/8/07 11:56 AM Page 89

---

pointing to several IPs using one DNS RR. Now we will try to cover more
advanced subjects, introduced by the bad guys to help with the stability of
their botnets against take downs.
Games and tricks used by the bad guys to do this vary, but they mostly
rely on the Time to Live (TTL) setting.The TTL determines how long the
results of a DNS query would be cached locally on any remote name server
that obeys the TLL. If the TTL is set to a very low setting (a small number),
the IP addresses the record points to can be rapidly and consistently changed.
“The TTL is a very interesting knob for working with DNS,
both for the good and bad guys.”
– Paul Vixie and Gadi Evron, defcon 14.
Dynamic DNS
Dynamic DNS, or DynDNS, is the name given to dynamic DNS providers.
What these providers basically do is to enable anyone to register an account
with them and get free DNS hosting services.You can set up your domain
name or use a 3LD with one they provide.Then point it to, for example, your
home IP address (which changes every time you get on the Internet if it is
dynamic).You could update the dynamic DNS information either via their
Web page or using a tool they provide, which will automatically detect your
new IP address and set your DNS records accordingly.
These services are perfect for the botnet controllers’ use.They can set up
any number of disposable hosts and change the IP addresses they point to
very frequently. For this purpose, naturally a low TTL is set.
The dynamic DNS services suffer enormously from this type of abuse and
often try to eliminate such abuse of their services.
Fastflux DNS
Fastflux is the name given to DNS records that change constantly, whether
every day or every 10 minutes.This was first introduced in the spam world,
where spammers would e-mail out spam messages and change the IP address
of the site they send people to all the time.The same was soon applied to
phishing sites, and indeed, botnet C&Cs.