- Test - lists.nanog.org

mitigating botnet C&Cs has become useless
by Gadi Evron 03 Aug '06

03 Aug '06

The few hundred *new* IRC-based C&Cs a month (and change), have been around and static (somewhat) for a while now. At a steady rate of change which maintains the status quo, plus a bit of new blood. In this post I ask the community about what you see, against what we have observed, and try and test my conclusions and numbers against your findings. The subject line "why mitigating botnet C&Cs has become useless" is misleading. It has been useless for a long time, but someone had to hold back the tide, which several online mitigation communities have been doing. Today it has become (close to) completely useless. I will present the case on why that is in my opinion, in a few bullets, and we can discuss what alternatives we have, or if perhaps I am misreading what's going on. *. When a botnet C&C is mitigated, it is immediately re-created on another host on the same ISP or another. *. Most botnet C&Cs are a part of a larger group, such as an IRC network or another, possibly hidden "behind the scenes" network. lusers are being redirected on the spot or reconnect to another host. *. Most botnet C&Cs are a compartmentalized group out of the whole, possibly a sub-group several tiers down. Much like a terrorism cell. *. If the above measures and features fail, most botnets have a secondary control channel with which an immense host can be re-directed. This has been seen back a few years ago. *. Many botnet C&Cs now use fast-flux technology, moving IP addresses quite often. *. When the C&C is taken down, the bot may not jump to a new host, a new one may simply be installed. *. Coordinated take-down of entire networks is extremely difficult, relies on incomplete intelligence and only takes care of the problem for an extremely short period of time until re-assembly. The name of the game is the SPBC: Simple Primitive Botnet Control (C&C). Simple - as it is simple, vs. a complex dynamic control channel. Primitive - old and quite unimpressive. Botnet - d'oh C&C - Command and Control It's simple, we can see most of them with our tools. Primitive, hey, they have been using these for a long long time. It works. As what we mainly did is concentrate on taking the C&C down, as well as academically study how to detect or quantify it, what we achieved was teaching the Bad Guys their business. That is yesterday's news. They are an oiled machine. We don't hurt them any more. Botnet have become mainstream. They are part of sales pitches now. SPBC for the botnet controllers these days relies on proven and tested techniques, concentarting and backing themselves on: Reliability - Efficient and stable. Robust - Easily replaced. Diverse - varying control channels, from DNS, other IRC servers and direct connect to a downloader ready to download a new bot or re-infect a known bad network. Distributed - need I speak of that one? What taking down C&C's does achieve? 1. Coordination on security issues between ISP's, continued and peer-pressure based. Slowly but surely becoming more and more LEO, regulation and vendor-run in comparison to what it used to be. 2. Responsiveness to abuse - gaging ISP response is interesting and shows how interested they are. 3. Feeling good - cleaning the back yard and moving the problem to someone else (another ISP). Hmm, yeah.. not really. In most cases the same ISP's have the same problems month after month. They just make the C&C's "unknwon" vs. "yes, we know where they are". We are now past the point where killing C&Cs has been harmful. It was. These days the only real use a C&C can have for an organization with a network, is to check for infected clients connecting in. When it was harmful, creating the current situation, we were comfortable with it as it helped hold back the immediate problem - which was important by itself. That's my educated opinion, following this since 1996, and gathering statistics for several years, some of which are seen by this community every month. Please, I would love to hear your opinions, disputes and how you find the operational intell on botnet C&Cs useful to this day on networks for mitigation purposes. Then I would like to try and check my facts against your findings as well, and see if my conclusions hold up or if I miscalculated. Please try and limit your answers on this thread (unless you start another) to network mitigation issues. Thank you all for your input. Oh, and I wasn't very accurate. Killing C&Cs these days is still harmful, just that now it doesn't even hold back the tide. Gadi. Note: this is also being sent to the public botnets mailing list.

4 4

Re: APC Matrix 5000 question(s)
by up＠3.am 03 Aug '06

03 Aug '06

On Thu, 27 Jul 2006, Michael J Wise wrote: > On Jul 27, 2006, at 5:10 AM, Ray Van Dolson wrote: > > > In any case, give APC support a holler. > > Definitely. > > > I'm always nervous doing any sort of maintenance on our Symmetra. > > The Symmetra is a completely different animal from the 5000, though. > I <3 the Symmetra. > > Oh yes, one more point... best to check the 5000's battery packs for > heat and bulging, as some of the packs may be about to vent the Hot > Sauce, and cleaning that up is always "Fun". Aloha mai Nai`a! -- "Please > have your Internet License http://kapu.net/~mjwise/ Update: I replaced the batteries today, and indeed, several of the old ones (mostly in the first pack) were split and some had popped a couple of their "sealed" tops. I left for several hours and came back to the house stinking like burning rubber. The new batteries are apparently melting the terminal rubber insulation. I had to throw it back into bypass mode and unplug that pack (the only one with new batteries!) Any ideas to the cause? The status screens looked ok. ("no bad batteries" again) James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

7 7

DNS BIND dispatch errors
by Simon Waters 03 Aug '06

03 Aug '06

The increase in dispatch errors reported by BIND recently is explained by the other ISC here; http://isc.sans.org/diary.php?storyid=1538 So it looks like the error message was right, although some older versions of BIND didn't do a good job of reporting the IP addresses involved. My own experience was the servers mentioned here aren't the only servers doing this rather bizarre behaviour, but it is likely they could account for the increase seen (in association with a spam run causing lookups).

1 0

RE: Good list for VoIP
by John Stuppi (jstuppi) 03 Aug '06

03 Aug '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Mike, You can try voipsec(a)voipsa.org: To subscribe or unsubscribe via the World Wide Web, visit http://voipsa.org/mailman/listinfo/voipsec_voipsa.org or, via email, send a message with subject or body 'help' to Voipsec-request(a)voipsa.org You can reach the person managing the list at Voipsec-owner(a)voipsa.org Thanks, John - -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Callahan Sent: Thursday, August 03, 2006 8:21 AM To: nanog(a)merit.edu Subject: OT: Good list for VoIP Sorry for the OT post but I'm wondering if anyone can recommend a good list for ISP level VoIP discussion. On that's focus is on technical issues would be preferred. Thanks, M. Callahan -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBRNHvX/EVU0zaWQwNEQLquwCeJQzrYfHXumL75krxKCuDAIn6N5AAoPXo VDyt7P6tvrmpXyehRNa90fBK =li6s -----END PGP SIGNATURE-----

1 0

Fwd: [apops] APNIC debogon project]
by Noel 03 Aug '06

03 Aug '06

Hi All, As I recall the no end of problems many of us had when APNIC issued 124/7, I'll get in early and ask that you please be advised of the following and make any required changes to your core equipment. Thanks.. -----Forwarded Message----- To: apnic-announce(a)apnic.net Subject: APNIC debogon project Date: Thu, 03 Aug 2006 10:32:10 +1000 Dear colleagues In January 2006, APNIC received the following IPv4 address ranges from IANA: - 121/8 - 122/8 - 123/8 APNIC has started making allocations from these address ranges. To ensure these ranges are not being accidentally filtered, selected prefixes from each /8 have been announced using AS12654. A reachability test can be done on each test prefix. A list of "pingable" hosts and a daily visibility report for each prefix is available here: http://www.ris.ripe.net/debogon/debogon.html If you need further assistance or have any concerns, please feel free to contact us at <helpdesk(a)apnic.net>.

1 0

RE: mitigating botnet C&Cs has become useless
by Fergie 02 Aug '06

02 Aug '06

-- "Barry Greene (bgreene)" <bgreene(a)cisco.com> wrote: >> >> What? That's what I'm trying to find out, but I'm not as >> smart as most, so I can only point out the things that I >> believe definitely won't work and why I think that. >> Hopefully by the application of flame to my butt by smart >> people for saying what I do will spark some thought toward the goal. > > >Start with: > >http://www.nanog.org/mtg-0602/greene.html > Also, I hope to be gving a presentation at the next NANOG (it might just turn out to be a "lightning talk" depending on the number of slides) which segues into this particular topic. :-) Now, I need to get to work on those slides.... :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: mitigating botnet C&Cs has become useless
by Barry Greene (bgreene) 02 Aug '06

02 Aug '06

> > What? That's what I'm trying to find out, but I'm not as > smart as most, so I can only point out the things that I > believe definitely won't work and why I think that. > Hopefully by the application of flame to my butt by smart > people for saying what I do will spark some thought toward the goal. Start with: http://www.nanog.org/mtg-0602/greene.html

1 0

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 02 Aug '06

02 Aug '06

----- Original Message Follows ----- From: Barry Shein <bzs(a)world.std.com> > On August 1, 2006 at 11:50 surfer(a)mauigateway.com (Scott > Weeks) wrote: > >... > > there has to be a technical way to do this, rather > > than a diplomatic way as the diplomatic ways > > historically have not worked in the other areas > > mentioned, so they probably won't work here, either. > > Or we have to keep going until one can be contrived. > > Many good attempts have been made and there will be > > more to come until we hopefully rid ourselves of the > > sickness others of lower values force on us daily... > > I have nothing against technical solutions tho after over > ten years of a lot of smart people trying, and a grand > prize of probably a billion dollars increase in personal > wealth, it doesn't seem forthcoming. > > However, I do take exception to the assertion that > "diplomatic ways historically have not worked in other > areas mentioned". > > I think what you mean is that they haven't worked > perfectly, but slipped the semantics a little. Surely you > didn't mean to say that all efforts to oppose, e.g., the > human slave trade have been in vain? > > The effectiveness has a lot to do with the profitability > making the risk worthwhile (e.g., drug trade), and who the > crime appeals to; some poor, desparate people will take > risks others won't (e.g., high-seas piracy.) > > Unfortunately all this reasoning might be edifying but it > leads nowhere. Yes, you're correct. I didn't mean to say the things you mentioned haven't worked at all. I'm just saying that there has to be a better way than police-type actions on a global scale. Also, I'm sure many more smart people will work on it for many more years and others will make billions more before it's solved. But it needs to be solved on the same playing field that the ugliness is occurring on. You don't solve San Diego's slave trade by kicking ass on Indonesia's pirates. Last, you're also correct that this is leading nowhere. I made my point and have now beat it to death. Thanks for listening... scott

5 5

RE: mitigating botnet C&Cs has become useless
by Fergie 02 Aug '06

02 Aug '06

"Jamie Bowden" <jamie(a)photon.com> wrote: [snip] >I'd just like to point out Paul, that while we may rely on police to >handle crimes in the real world, we still lock our doors. > >Jamie Bowden Indeed. And good neighbors usually alert the police when someone is breaking into their neighbor's house -- it's called "community watch." Alternatively, some people also call the cops when someone is firing a sniper rifle from a neighboring house into the surrounding neighborhood, as well. :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Odd named messages...
by Dominic J. Eidson 02 Aug '06

02 Aug '06

Has anyone else seen an increase of the following named errors? Aug 1 01:00:09 morannon /usr/sbin/named[21279]: dispatch 0x4035bd70: shutting down due to TCP receive error: unexpected error Aug 1 01:00:09 morannon /usr/sbin/named[21279]: dispatch 0x4035bd70: shutting down due to TCP receive error: unexpected error .. someone trying some new anti-bind trickery? - d. -- Dominic J. Eidson "Baruk Khazad! Khazad ai-menu!" - Gimli ------------------------------------------------------------------------------- http://www.the-infinite.org/

2 1