4 ms·

> Nothing to do with `strings`. The purpose of domain generation algorithms is simply to prevent bot loss from domain suspension/C&C takedowns. The purpose of

> Nothing to do with `strings`. The purpose of domain generation algorithms is simply to prevent bot loss from domain suspension/C&C takedowns. The purpose of DGA is also to make it harder to identify the domains the malware will use. One of those ways is to run strings on an executable and look for domain names. As they made no attempt to move off their main domains, we can assume that wasn't the goal. Rather, the goal of this is pretty clearly to add a few new domain names which are not as obvious and thus less likely to be blocked. Certainly not the perfect solution, but see my previous about premature optimization. Also, I think you're overestimating the ease of taking over someone else's registrant account. Possible? Absolutely. Easy? Well, that depends on a great many things, but typically not easy without a court order.

goatsi 10y ago
You don't have to take over their account, you just need to make it so that their domains no longer resolve. Once that happens the DGA kicks in and all the bots connect to the DGA domain you have registered. You are also telling the wrong person that hijacking domains is hard, ask him about mit.edu.
ryanlol 10y ago
Are you just coming up with new uses for domain generation algorithms to refute my comment for the sake of refuting it, or do you personally know the developer? Or do you at least personally know developers who have used DGAs for that? I've seen lots of DGAs, but I've never seen one being used for the purpose you're describing. You're suggesting a pretty novel use case here, why is that? >Also, I think you're overestimating the ease of taking over someone else's registrant account. Possible? Absolutely. Easy? Well, that depends on a great many things, but typically not easy without a court order. While it's not at all what I was referring to, many domain registrars are actually surprisingly happy to just hand over malware domains to "whitehats". See goatsis comment for the issue I was originally referring to.
- Godel_unicode 10y ago
  My experience differs from yours. Apparently goatsis has heard of you, so good work on that? The logical fallacy of either/or doesn't advance your argument as much as you think it does. In my experience, malware authors care about beating the defense more than they do about having their domains taken down by some "whitehat". Although if you think that's easy, by all means please do. The Internet will thank you.
  - ryanlol 10y ago
    Instead of relying on the fallacy fallacy could you try to back up your point of view somehow? Share your differing experiences and give us some examples. The idea of using a DGA to hide your C&C simply isn't a very good one. It's not going to work, anyone running a packet capture will still see where your bot connects. Using a DGA to protect your C&C from being taken down? You can easily make it impossible for any domain registry to shut you down. It'll also protect you from server suspensions as you'll just be able to update your DNS records. One of these actually works, one doesn't. For hiding your C&C you'd want to use tor hidden services instead. Generally C&Cs are disposable though, so there's no need to hide them in the first place. >In my experience, malware authors care about beating the defense more than they do about having their domains taken down by some "whitehat". I don't really understand what you mean here. "beating the defense"? Are you suggesting that whoever did this mirai edit was trying to evade antiviruses or any sort of "defense" in that matter? On iot devices and routers? I'm sure they weren't hoping that whatever analyst finds their binary isn't going to find their C&C... Which seems to be what you're suggesting. But if they aren't worried about their C&C being taken down by some "whitehat" then why on earth would they want to hide it in the first place?

goatsi 10y ago

You don't have to take over their account, you just need to make it so that their domains no longer resolve. Once that happens the DGA kicks in and all the bots connect to the DGA domain you have registered. You are also telling the wrong person that hijacking domains is hard, ask him about mit.edu.

ryanlol 10y ago

Are you just coming up with new uses for domain generation algorithms to refute my comment for the sake of refuting it, or do you personally know the developer? Or do you at least personally know developers who have used DGAs for that? I've seen lots of DGAs, but I've never seen one being used for the purpose you're describing. You're suggesting a pretty novel use case here, why is that? >Also, I think you're overestimating the ease of taking over someone else's registrant account. Possible? Absolutely. Easy? Well, that depends on a great many things, but typically not easy without a court order. While it's not at all what I was referring to, many domain registrars are actually surprisingly happy to just hand over malware domains to "whitehats". See goatsis comment for the issue I was originally referring to.

Godel_unicode 10y ago
My experience differs from yours. Apparently goatsis has heard of you, so good work on that? The logical fallacy of either/or doesn't advance your argument as much as you think it does. In my experience, malware authors care about beating the defense more than they do about having their domains taken down by some "whitehat". Although if you think that's easy, by all means please do. The Internet will thank you.
- ryanlol 10y ago
  Instead of relying on the fallacy fallacy could you try to back up your point of view somehow? Share your differing experiences and give us some examples. The idea of using a DGA to hide your C&C simply isn't a very good one. It's not going to work, anyone running a packet capture will still see where your bot connects. Using a DGA to protect your C&C from being taken down? You can easily make it impossible for any domain registry to shut you down. It'll also protect you from server suspensions as you'll just be able to update your DNS records. One of these actually works, one doesn't. For hiding your C&C you'd want to use tor hidden services instead. Generally C&Cs are disposable though, so there's no need to hide them in the first place. >In my experience, malware authors care about beating the defense more than they do about having their domains taken down by some "whitehat". I don't really understand what you mean here. "beating the defense"? Are you suggesting that whoever did this mirai edit was trying to evade antiviruses or any sort of "defense" in that matter? On iot devices and routers? I'm sure they weren't hoping that whatever analyst finds their binary isn't going to find their C&C... Which seems to be what you're suggesting. But if they aren't worried about their C&C being taken down by some "whitehat" then why on earth would they want to hide it in the first place?