[gnso-ff-pdp-may08] Who benefits from fast flux activities, and who is harmed?

[Dave Piscitello <dave.piscitello@xxxxxxxxx>]

I previously suggested that we break it down into "Who benefits from the use
of short TTLs?" and "Who is harmed by fast flux activities?". I'm continuing
this thread using that theme.

I've tried to capture ideas from Joe, Wendy, Eric and others from prior
emails before re-posting this so it is different/longer than my original
post.

"Who is harmed by fast flux activities?"

1. Individuals whose computers are infected by attackers and subsequently
used to host name servers or web sites for a fast flux phishing attack. The
individual may have his Internet connection blocked. In the extreme, should
the computer be suspected of hosting illegal material, the computer may be
seized by law enforcement agents (LEAs) and the individual may be subjected
to a criminal investigation.

2. Businesses and organizations whose computers are infected may have
Internet connections blocked, which may result in loss of connectivity for
all users as well as the possible loss of connectivity for any Internet
services also hosted via the blocked connection (e.g., mail, web, e-merchant
or ecommerce sites). Again, in the extreme, should the computer be suspected
to host illegal material, the computer may be seized by LEAs and the
individual may be subjected to a criminal investigation. If this computer
were hosting web and other services for the business/organization, the
seizure could also result in an interruption of service, loss of income or
"web presence".

3. Individuals who receive phishing emails and are lured to a phishing site
hosted on a bot used by the miscreants/criminals who run the phishing attack
may have their identities stolen or suffer financial loss from credit card,
securities or bank fraud. They may unwittingly disclose medical or personal
information that could be used for blackmail or coersion. They may infect
their computers with malicious software that would "enlist" their computers
into a bot herd. Individuals who purchase bogus products, especially
pharmaceuticals, may be  physically harmed from using such products.

4. Internet access operators are harmed when their IP address blocks are
associated with bot nets and phishing attacks that are linked to fast flux
activities. These operators also bear the burden of switching the
unauthorized traffic that phishing attacks generate and they may also incur
the cost of diverting staff and resources to respond to abuse reports or
legal inquiries.

5. Registrars are harmed when their registration and DNS hosting services
are used to abet "double flux" attacks. Like Internet access providers, they
may also incur the cost of diverting staff and resources to monitor abuse,
or to respond to abuse reports or legal inquiries.

6. Businesses and organizations who are "phished" from bogus web sites
hosted on fast fluxing networks may experience financial or material loss,
tarnish to brand, or loss of customer/consumer confidence. They also incur
the cost associated with brand abuse monitoring, detection and mitigation.

7. Individuals or businesses whose lives or livelihoods are affected by the
illegal activities abetted through fast flux networks, as are persons who
are defrauded of funds or identities, whose products are imitated or brands
infringed upon, and persons who are exploited emotionally or physically by
the distribution of images or enslavement.

8. Registries may incur the cost of diverting staff and resources to monitor
abuse or to respond to abuse reports or legal inquiries.

Who benefits from the use of short TTLs?

1. Organizations that operate highly targetable networks (e.g., government
and military/tactical networks) that must adhere to very stringent
availability metrics and use short TTLs to rapidly relocate network
resources which may come under attack (Assumes the attack
targets a dotted quad and not a FQDN.

(From Joe St. Sauver: Targetting a dotted quad rather than a FQDN is
generally preferred by intelligent attackers because then you avoid creating
a "steerable death ray" which can be repointed by whomever controls the DNS
for the targeted domain name)

2. Content distribution networks such as Akamai, where "add, drop, change"
of servers are common activities to complement existing servers with
additional capacity, to load balance or location-adjust servers to meet
performance metrics (latency, for example, can be reduced by making servers
available that are fewer hops from the current most active locus of users
and by avoiding lower capacity or higher cost international/intercontinental
transmission links).

3. Organizations that provide channels for free speech, minority advocacies,
and activities, revolutionary thinking may use short TTLs and operate
fast-flux like networks to avoid detection.