Friday, January 30, 2009

Understanding Fast-Flux networks

Fast-Flux networks are an advanced methodology in the spread of threats that are currently exploited in an active way to infect computers (among other crimes). The goal is to hide the IP addresses through which rotate in seconds against the same domain, making it impossible to locate in order to block their identification difficult.

Each of these IP addresses that are assigned to domains, are machines that have previously been involved with some malicious code as part of a botnet, and work as a "bridge" between the team and requesting specific action the server hosting the resource. This method of operation of the network is called the Single-Flux.

That is, in a normal process a client makes a request (GET) to the server which then responds by offering the customer the result in single-flux networks, the original request made by the client doesn't bounce against the server but it does against the zombie machine, and this is who performs the query to the server.

There is another method called the Double-Flux which, in addition to providing the features of single-flux, the operating name resolution and registration services for domain names.

Through a simple DNS query against a domain is possible to establish whether this is part of a Fast-Flux network. In the following example showing the different IP addresses that are set to the domain

; IN A

;; ANSWER SECTION: 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A 600 IN A

;; AUTHORITY SECTION: 345600 IN NS 345600 IN NS 345600 IN NS 345600 IN NS 345600 IN NS

On the other hand, say that a picture is worth a thousand words so ... let's see what he says the following, obtained from SecViz created by Jaime Blasco:

The representation of Fast-Flux networks using graphic tools is an excellent alternative since it allows, through a single view, hear from a structural point of view and very attractive as comprising such a network.

In this example, the chart shows a series of Fast-Flux domains (blue) and each of the zombie PCs that comprise it (red). In making the triangulation of each of the domains infected, we noticed that some belong to multiple networks within an FF network structure.

This implies greater advantage to the attacker because it has a far wider range of teams that are used in a distributed manner to spread malware much, much more spread spam, make much of phishing attacks, and many other activities malicious and fraudulent.

# Jorge Mieres

No comments: