427 Botnet fm qxd

www.syngress.com
90
Chapter 3 • Alternative Botnet C&Cs
427_Botnet_03.qxd 1/8/07 11:56 AM Page 90

---

With the bot going to the DNS name rather than the IP address, even if
the IP address representing the C&C server goes down, it can be immediately
moved to a different IP address, without ever issuing one instruction to the
botnet. Often, the constant change of IP addresses will occur regardless of
whether a takedown of the C&C happened.This is one of the reasons taking
down botnet C&Cs has become impractical to a large extent.
An interesting way to track such changes is by the use of the passive DNS
replication system created by Florian Weimer. For a more-detailed explana-
tion see www.enyo.de/fw/software/dnslogger/.The system caches all DNS
results (not the actual requests) it sees while monitoring large DNS servers.
An example result (courtesy of Florian Weimer):
2004-07-11 08:08:57
georgewbush.com
A
64.203.97.121
2004-07-12 02:12:40
www.georgewbush.com
A
64.203.97.121
2004-07-12 16:45:34
www.georgebush.com
A
64.203.97.121
2004-07-19 12:54:29
democratsforbush.net
A
64.203.97.121
2004-07-26 13:13:42
www.bushforpresident.com
A
64.203.97.121
2004-07-30 18:02:06
georgebush.com
A
64.203.97.121
2004-09-02 21:00:34
www.studentsforbush.com
A
64.203.97.121
2004-09-30 02:05:07
www.agendaforamerica.com
A
64.203.97.121
2004-10-01 05:37:03
www.debatefacts.com
A
64.203.97.121
2004-10-14 00:21:10
www.kerrysliberalrecord.com
A
64.203.97.121
2004-10-20 16:12:56
kimble.org
A
64.203.97.121
2004-10-31 05:00:04
teachersforbush.org
A
64.203.97.121
This example shows different DNS A records pointing to just one IP
address. An interesting domain to watch for from the above is kimble.org,
which helped Blaster.E take down a presidential campaign Web site.The date
in the table above shows the time when the result was first seen by the
system.
More information on fastflux DNS can be found at the Spamhaus Web
site: www.spamhaus.org/faq/answers.lasso?section=ISP%20Spam%20
Issues#164.
Future Outlook
In the future, we can expect to see far more use of fastflux technology, as well
as new C&C technologies being introduced. Still, IRC is going to stay with