Depending on the configuration and complexity of the infrastructure, fast-fluxing is generally classified into single, double, and domain fast-flux networks. Fast-fluxing remains an intricate problem in network security and current countermeasures remain ineffective.
History
Fast-fluxing was first reported by the security researchers William Salusky and Robert Danford of The Honeynet Project in 2007;[3] the following year, they released a systematic study of fast-flux service networks in 2008.[4]Rock Phish (2004) and Storm Worm (2007) were two notable fast-flux service networks which were used for malware distribution and phishing.[5]
The frontend bots, which act as an ephemeral host affixed to a control master, are called flux-agents whose network availability is indeterminate due to the dynamic nature of fast-fluxing.[1] The backend motherships do not establish direct communication with the user agents, rather every actions are reverse proxied through compromised frontend nodes,[8] effectively making the attack long-lasting and resilient against take down attempts.[9]
Types
Fast-fluxing is generally classified into two types: single fluxing and double fluxing, a build-on implementation over single fluxing. The phraseologies involved in fast-fluxing includes "flux-herder mothership nodes" and "fast-flux agent nodes", referred to the backend bulletproof botnet controller and the compromised host nodes involved in reverse proxying the traffic back-and-forth between the origin and clients respectively.[10][1] The compromised hosts used by the fast-flux herders typically includes residential broadband access circuits, such as DSL and cable modems.[11]
Double-fluxing networks involve high-frequency permutation of the fluxing domain's authoritative name servers, along with DNS resource records such as A, AAAA, or CNAME pointing to frontend proxies.[15][16] In this infrastructure, the authoritative name server of the fluxing domain points to a frontend redirector node, which forwards the DNS datagram to a backend mothership node that resolve the query.[17][18] The DNS resource records, including the NS record, are set with a lower TTL value, therefore resulting in an additional level indirection.[19][20] The NS records in a double-fluxing network usually point to a referrer host that listens on port 53, which forwards the query to a backend DNS resolver that is authoritative for the fluxing domain.[21][22]: 6 Advanced level of resilience and redundancy is achieved through blind proxy redirection techniques of the frontend nodes;[22]: 7 Fast-fluxing domains also abuse domain wildcardingRFC1034 specification for spam delivery and phishing, and use DNS covert channels for transferring application layer payloads of protocols such as HTTP, SFTP, and FTP encapsulated within a DNS datagram query.[23][22]: 6-7
Domain-flux network
Domain-flux network involves keeping a fast-fluxing network operational through continuously rotating the domain name of the flux-herder mothership nodes.[23] The domain names are dynamically generated using a selected pseudorandomdomain generation algorithm (DGA), and the flux operator mass-registers the domain names. An infected host repeatedly tries to initiate a flux-agent handshake by spontaneous generating, resolving and connecting to an IP address until an acknowledgment, to register itself to the flux-herder mothership node.[19] A notable example includes Conficker, a botnet which was operational by generating 50,000 different domains in 110 top-level domains (TLDs).[24]
Security countermeasures
The detection and mitigation of fast-fluxing domain names remain an intricate challenge in network security due to the robust nature of fast-fluxing.[25] Although fingerprinting the backend fast-flux mothership node remains increasingly difficult, service providers could detect the upstream mothership nodes through probing the frontend flux-agents in a special way by sending a crafted HTTP request that would trigger an out-of-band network request from the backend fast-flux mothership node to the client in an independent channel, such that the client could deduce the mothership node's IP address by analyzing the logs of its network traffic.[26] Various security researchers suggests that the effective measure against fast-fluxing is to take down the domain name from its use. However, the domain name registrars are reluctant in doing so, since there are not jurisdiction independent terms of service agreements that must be observed; in most cases, fast-flux operators and cybersquatters are the main source of income to those registrars.[27]