4 ms·

Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on

Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.

justsomedood 12y ago
I'm sure they're using compromised hosts for the servers, which would change pretty often
nucleardog 12y ago
How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.
- dublinben 12y ago
  Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
  - nucleardog 12y ago
    It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.
superuser2 12y ago
Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?

justsomedood 12y ago

I'm sure they're using compromised hosts for the servers, which would change pretty often

nucleardog 12y ago

How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server? You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment. Or, you just have a centralized place to list the authoritative address of the current master. But you don't want to host that yourself - that's a link back to you. Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.

dublinben 12y ago
Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.
- nucleardog 12y ago
  It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really. If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.

superuser2 12y ago

Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?