Fast Flux Hosting - A Spammers Favorite
A recent article that was put out by ICANN reads as follows. The article was mirrored here to allow readers to fully digest and get the story. We wish everyone that is interested in it, please send in your comments or Comments on the Initial Report should be sent to fast-flux-initial-report@icann.org. Original artical can be seen at ICANN. Public comments sent to and received by ICANN, can be accessed at http://forum.icann.org/lists/fast-flux-initial-report
Background
Fast flux refers to rapid and repeated changes to A and/or NS resource records in a DNS zone, which
have the effect of rapidly changing the location (IP address) to which the domain name of an Internet host
(A) or name server (NS) resolves. Although some legitimate uses for this technique are known (see
below), it has within the past year become a favorite tool of phishers and other cyber-criminals who use it
to evade detection by anti-crime investigators.
How fast flux works4
The goal of fast-flux is for a fully qualified domain name (such as www.example.com) to have multiple IP
addresses (hundreds or even thousands) assigned to it. These IP addresses are changed in and out of
zone file A (host address) and/or NS (name server) records with extreme frequency, using a combination
of round-robin IP addresses and a very short time-to-live (TTL). Web site host names may be associated
with a new set of IP addresses which can change rapidly. A browser connecting to the same web site
repeatedly over a short period of time could actually be connecting to a different infected computer each
time. In addition, the attackers ensure that the compromised systems they are using to host their scams
have the best possible bandwidth and service availability. They often use a load-distribution scheme
which takes into account node health-check results, so that unresponsive nodes are taken out of flux and
content availability is always maintained.
4 The material in this section is based on, and in some cases taken verbatim from, the description at
http://www.honeynet.org/papers/ff/fast-flux.html.
Proxy redirection adds a second layer of obfuscation to fast flux. When someone hosting maliciouscontent
(a phishing site, for example) uses a fast-flux network, the hosts that are “fluxed” (by rapidlychanging
the IP address to which the domain name resolves) are typically proxies that redirect queries to
the site that contains the attacker’s actual content. That’s simpler for the attacker, because instead of
having to copy his malicious content to many different bots, he can put it on one host, and deploy a botnet
of redirecting proxies that all point to that host. The fluxing then takes place among the redirectors.
Redirection disrupts attempts to track down and mitigate fast-flux service network nodes. The domain
names and URLs for advertised content no longer resolve to the IP address of a specific server, but
instead fluctuate amongst many front-end redirectors or proxies, which then in turn forward content to
another group of backend servers. While this technique has been used for some time in the world of
legitimate webserver operations, for the purpose of maintaining high availability and spreading load, in
this case it is evidence of the technological evolution of criminal computer networks.
Fast-flux “motherships” are the controlling element behind fast-flux service networks, and are similar to
the command and control (C&C) systems found in conventional botnets. However, compared to typical
botnet servers, fast-flux motherships have many more features. It is the upstream fast-flux mothership
node, which is hidden by the front end fast-flux proxy network nodes, that actually delivers content back
to the victim client who requests it. Certain fast flux command and control systems employ peer to peer
(P2P) applications and so operate successfully for extended periods of time in the wild. These nodes are
often observed hosting both DNS and HTTP services, with web server virtual hosting configurations able
to manage the content availability for thousands of domains simultaneously on a single host.
Fast-flux networks are responsible for many malicious practices, including online pharmacy shops, money
mule recruitment sites, phishing web sites, extreme/illegal adult content, malicious browser exploit web
sites, and the distribution of malware downloads. Beyond DNS and HTTP, other services such as SMTP,
POP, and IMAP can be delivered via fast-flux service networks. Because fast-flux techniques utilize TCP
and UDP redirects, any directional service protocol with a single target port would likely encounter few
problems being served via a fast-flux service network—so it's not just web sites; it could also be fraudulent
email sites.
Legitimate uses of fast flux
From preliminary research, staff understands that some high-capacity load-balancing systems may rely
on short time-to-live values in the DNS records that resolve their principal domain names (e.g.,www.google.com)
to IP addresses in order to propagate changes quickly.5 A high-traffic site might use this technique—which
satisfies the definition of “fast flux”—to adapt its home page addresses to internal and external network
conditions, such as server load, outages, user location, and resource reconfiguration. Because almost all
web browsers cache domain name lookups for at least 15-20 minutes, regardless of the advertised TTL, the
net effect of a short TTL is to set the actual timeout to the “attention horizon” of the browser. The ability
to reconfigure quickly is considered by these service providers to be important enough to offset the additional
query latency introduced by more-frequent DNS lookups. More research is needed to better understand legitimate
uses and their prevalence.
Staff also understands that service providers might be able to fast-flux their IP addresses to deal with
situations in which a government or other actor is deliberately blocking (“black-holing”) their addresses
inan effort to prevent access to their services from within a country or region. This was described
anecdotally as a possible “legitimate use”. This is another area where both technical issues may need to
be better understood to inform further discussion.
Why fast flux is a problem
Phishing, pharming, and other malicious (and frequently illegal) activities represent a well-known threat to
the safety and security of Internet users. Those engaged in these activities can frustrate the efforts of
investigators to locate and shut down their operations by using fast flux service networks to rapidly and
continuously change the IP address at which their content is hosted, staying “one step ahead” of their
law-enforcement pursuers.
Single-flux service networks change the DNS records for their front end node IP address as often as
every 3-10 minutes, so even if one flux-agent redirector node is shut down, many other infected redirector
hosts are standing by and available to quickly take its place. Fast-flux networks tend to be composed
primarily of compromised home computers, because unlike the computing infrastructure of a company or
other organization with an IT department, home computers are difficult to protect with anti-malware
measures.
5 Information received by Staff suggests that TTLs of 300 seconds may be typical in these configurations.
Again,more research is needed to verify. Fast-flux service networks create robust, obfuscating service
delivery infrastructures that make it difficultfor system administrators and law enforcement agents to
shut down active scams and identify the criminals operating them.
Why ICANN should be concerned about fast flux
The community of researchers, system administrators, law enforcement officials, and consumer
advocates who are fighting Internet scams that are enabled or accelerated by fast flux hosting have
concluded that trying to thwart fast flux hosting by detecting and dismantling the botnets (fast flux service
networks) is not effective. Other measures that require the cooperation of DNS registries and registrars to
identify or defeat fast flux techniques are expected to be much more effective. ICANN should consider
whether and how it might encourage registry operators and registrars to take steps that would help to
reduce the damage done by cybercriminals by curtailing the effectiveness of these DNS-based exploits.
Discussion of possible directions
ICANN Staff research has confirmed that fast flux hosting:
• is a real phenomenon—it has been observed, documented, and reported by a variety of reputable
sources, including members of the Anti-Phishing Working Group;
• makes it more difficult for investigators to identify and shut down malicious activity; and
• could be significantly curtailed by changes in the way in which DNS registries and registrars
currently operate.
Because fast flux hosting involves many different players—the cybercriminals and their victims, ISPs,
companies that provide web hosting services, and DNS registries and registrars—it is possible to imagine
a variety of different approaches to mitigation. The SSAC advisory identifies three approaches to
mitigation, each of which requires the cooperation of a different set of actors:
• eliminate botnets (users and ISPs);
• identify and shut down the fast flux hosts (ISPs); and
• change the way in which registries and registrars handle zone updates, which may reduce fast
flux or make it unattractive (registries and registrars). As explored further below, more research
and discussion is needed to explore the effectiveness of various options over time.
Anti-cybercrime experts have told Staff that trying to stop phishing and other Internet fraud by eliminating
botnets is futile. Most botnets are assembled from compromised computers connected to residential
broadband networks (for example, DSL or cable), and it is just too easy to spread malware among that
population; and although it might be possible to get ISPs in some countries to cooperate in the
identification and elimination of botnets, some ISPs may be out of reach and provide “safe havens” for
malicious botnet operators.
Anti-cybercrime investigators and law enforcement officials are often able to obtain court orders to shut
down phishing and pharming sites when they are identified, but fast flux is designed specifically to evade
these “takedown” efforts by making it difficult to track illegal activity and identify its actual location.
Registries and registrars can curb the practice in two ways: (1) by monitoring DNS activity (fast flux is
easy to detect) and reporting suspicious behavior to law enforcement or other appropriate reporting
mechanism; and (2) by adopting measures that make fast flux either harder to perform or unattractive.
Some possible measures that have been suggested include:
• authenticating contacts before permitting changes to NS records;
• preventing automated NS record changes;
• enforcing a minimum “time to live” (TTL) for name server query responses 6;
• limiting the number of name servers that can be defined for a given domain; and
• limiting the number of address record (A) changes that can be made within a specified time
interval to the name servers associated with a registered domain.7
While these measures have been suggested, each may have further implications that staff recommends
be explored. It should be noted that the GNSO policy development process is one of several ways that
fast flux hosting might be addressed within the ICANN community. This section describes the various
mechanisms for addressing this issue in order to inform the ICANN community of possible directions that
may be taken.
--------------------------
6 30 minutes has been suggested as a reasonable TTL lower bound, and staff understands that some registrars have
implemented a 30 minute TTL. Registries and registrars might be able to define exception conditions for legitimate
uses of shorter TTLs but it may be difficult in practice to differentiate legitimate uses from malicious applications.
7 It is possible that legitimate activities may not be hurt by limiting the number of name servers for a given domain
to 5, and limiting the number of changes to 5 per month
--------------------------------------
Spacequad has posted their response to ICANN and have made a copy available below.
What's Related