4 ms·

According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour. http://blog.unmaskparasites.com/2009/

According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour. http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-botnet-of-zombie-web-servers/ http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-b... >However since hackers add new domain names every hour, 100+ new hostnames need to be blocked. I’ve sent a few updates to both services, but they haven’t yet responded and I guess we’ll need to wait until Monday when they get back to work.

dublinben 12y ago
Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.
- justsomedood 12y ago
  I'm sure they're using compromised hosts for the servers, which would change pretty often
- nucleardog 12y ago
  How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
  - dublinben 12y ago
    Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
    - nucleardog 12y ago
      It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
- superuser2 12y ago
  Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?

dublinben 12y ago

Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.

justsomedood 12y ago
I'm sure they're using compromised hosts for the servers, which would change pretty often
nucleardog 12y ago
How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
- dublinben 12y ago
  Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
  - nucleardog 12y ago
    It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
superuser2 12y ago
Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?