Fast flux is adomain name system (DNS) basedevasion technique used bycyber criminals to hidephishing andmalware delivery websites behind an ever-changing network of compromised hosts acting asreverse proxies to the backendbotnet master—abulletproofautonomous system.[1] It can also refer to the combination ofpeer-to-peer networking, distributedcommand and control, web-basedload balancing andproxy redirection used to make malware networks more resistant to discovery and counter-measures.
The fundamental idea behind fast-flux is to have numerousIP addresses associated with a singlefully qualified domain name, where the IP addresses are swapped in and out with extremely high frequency, through changingDNS resource records, thus theauthoritative name servers of the said fast-fluxingdomain name is—in most cases—hosted by the criminal actor.[2]
Depending on the configuration and complexity of the infrastructure, fast-fluxing is generally classified into single, double, and domain fast-flux networks. Fast-fluxing remains an intricate problem innetwork security and current countermeasures remain ineffective.
Fast-fluxing was first reported by the security researchers William Salusky and Robert Danford ofThe Honeynet Project in 2007;[3] the following year, they released a systematic study of fast-flux service networks in 2008.[4]Rock Phish (2004) andStorm Worm (2007) were two notable fast-flux service networks which were used for malware distribution and phishing.[5]
A fast-flux service network (FFSN) is anetwork infrastructure resultant of the fast-fluxed network of compromised hosts; the technique is also used by legitimate service providers such ascontent distribution networks (CDNs) where thedynamic IP address is converted to match the domain name of theinternet host, usually for the purpose of load balancing usinground-robin domain name system (RR-DNS).[6] The purpose of using FFSN infrastructure for the botnets is torelay network requests and act as a proxy to the backendbulletproof content server which function as an "origin server".[7]
Thefrontend bots, which act as an ephemeral host affixed to acontrol master, are called flux-agents whose network availability is indeterminate due to the dynamic nature of fast-fluxing.[1] The backend motherships do not establish direct communication with theuser agents, rather every actions are reverse proxied through compromised frontend nodes,[8] effectively making the attack long-lasting and resilient against take down attempts.[9]
Fast-fluxing is generally classified into two types: single fluxing and double fluxing, a build-on implementation over single fluxing. The phraseologies involved in fast-fluxing includes "flux-herder mothership nodes" and "fast-flux agent nodes", referred to the backendbulletproof botnet controller and the compromisedhost nodes involved in reverse proxying the traffic back-and-forth between theorigin and clients respectively.[10][1] The compromised hosts used by the fast-flux herders typically includesresidential broadband access circuits, such asDSL andcable modems.[11]
In single-flux network, theauthoritative name server of a fast-fluxing domain name repeatedlypermutes theDNS resource records with lowtime to live (TTL) values, conventionally between 180 and 600 seconds. The permuted record within thezone file includesA, AAAA andCNAME record, the disposition is usually done by means ofround robin from a registry of exploited host's IP addresses andDDNS names.[12][13][14] AlthoughHTTP andDNS remain commonly proxiedapplication protocols by the frontend flux-agents, protocols such asSMTP,IMAP andPOP can also be delivered throughtransport layer (L4)TCP andUDP levelport binding techniques between flux-agents and backend flux-herder nodes.[15]
Double-fluxing networks involve high-frequency permutation of the fluxing domain's authoritative name servers, along with DNS resource records such as A, AAAA, or CNAME pointing to frontend proxies.[15][16] In this infrastructure, the authoritative name server of the fluxing domain points to a frontend redirector node, which forwards theDNS datagram to a backend mothership node that resolve the query.[17][18] The DNS resource records, including the NS record, are set with a lower TTL value, therefore resulting in an additionallevel indirection.[19][20] The NS records in a double-fluxing network usually point to a referrer host that listens onport 53, which forwards the query to a backend DNS resolver that is authoritative for the fluxing domain.[21][22]: 6 Advanced level of resilience and redundancy is achieved throughblind proxy redirection techniques of the frontend nodes;[22]: 7 Fast-fluxing domains also abusedomain wildcardingRFC 1034 specification for spam delivery and phishing, and useDNS covert channels for transferring application layer payloads of protocols such as HTTP,SFTP, and FTP encapsulated within a DNS datagram query.[23][22]: 6-7
Domain-flux network involves keeping a fast-fluxing network operational through continuously rotating the domain name of the flux-herder mothership nodes.[23] The domain names are dynamically generated using a selectedpseudorandomdomain generation algorithm (DGA), and the flux operator mass-registers the domain names. An infected host repeatedly tries to initiate aflux-agent handshake by spontaneous generating, resolving and connecting to an IP address until anacknowledgment, to register itself to the flux-herder mothership node.[19] A notable example includesConficker, a botnet which was operational by generating 50,000 different domains in 110top-level domains (TLDs).[24]
The detection and mitigation of fast-fluxing domain names remain an intricate challenge in network security due to the robust nature of fast-fluxing.[25] Althoughfingerprinting the backend fast-flux mothership node remains increasingly difficult, service providers could detect the upstream mothership nodes throughprobing the frontend flux-agents in a special way by sending acrafted HTTP request that would trigger anout-of-band network request from the backend fast-flux mothership node to the client in anindependent channel, such that the client could deduce the mothership node's IP address byanalyzing the logs of its network traffic.[26] Varioussecurity researchers suggests that the effective measure against fast-fluxing is to take down the domain name from its use. However, thedomain name registrars are reluctant in doing so, since there are not jurisdiction independentterms of service agreements that must be observed; in most cases, fast-flux operators andcybersquatters are the main source of income to those registrars.[27]
Other countermeasures against fast-fluxing domains includedeep packet inspection (DPI),host-based firewall, and IP-basedaccess control lists (ACLs), although there are serious limitations in these approaches due to the dynamic nature of fast-fluxing.[28]
{{cite journal}}:Cite journal requires|journal= (help)