Re: [gnso-ff-pdp-may08] Who benefits from fast flux activities, and who is harmed?

["Mike O'Connor" <mike@xxxxxxxxxx>]

great job Dave.

others -- note some of the things that are going on here;

- the subject line of the email is the "question" -- it will make it 
easier to follow these threads if we each follow this convention
- the content of the thread is framed as "an answer to the question" 
-- which makes it feasible to quickly transcribe this into the various reports.
a hint -- if you have suggestions/disagreements/etc. consider 
developing alternative versions of the paragraphs (in addition to 
stating your reasoning).  again, that will make it easier to transcribe.
thanks Dave,

m

At 01:18 PM 7/11/2008, Dave Piscitello wrote:



> I previously suggested that we break it down into "Who benefits from the use
> of short TTLs?" and "Who is harmed by fast flux activities?". I'm continuing
> this thread using that theme.
>
> I've tried to capture ideas from Joe, Wendy, Eric and others from prior
> emails before re-posting this so it is different/longer than my original
> post.
>
> "Who is harmed by fast flux activities?"
>
> 1. Individuals whose computers are infected by attackers and subsequently
> used to host name servers or web sites for a fast flux phishing attack. The
> individual may have his Internet connection blocked. In the extreme, should
> the computer be suspected of hosting illegal material, the computer may be
> seized by law enforcement agents (LEAs) and the individual may be subjected
> to a criminal investigation.
>
> 2. Businesses and organizations whose computers are infected may have
> Internet connections blocked, which may result in loss of connectivity for
> all users as well as the possible loss of connectivity for any Internet
> services also hosted via the blocked connection (e.g., mail, web, e-merchant
> or ecommerce sites). Again, in the extreme, should the computer be suspected
> to host illegal material, the computer may be seized by LEAs and the
> individual may be subjected to a criminal investigation. If this computer
> were hosting web and other services for the business/organization, the
> seizure could also result in an interruption of service, loss of income or
> "web presence".
>
> 3. Individuals who receive phishing emails and are lured to a phishing site
> hosted on a bot used by the miscreants/criminals who run the phishing attack
> may have their identities stolen or suffer financial loss from credit card,
> securities or bank fraud. They may unwittingly disclose medical or personal
> information that could be used for blackmail or coersion. They may infect
> their computers with malicious software that would "enlist" their computers
> into a bot herd. Individuals who purchase bogus products, especially
> pharmaceuticals, may be  physically harmed from using such products.
>
> 4. Internet access operators are harmed when their IP address blocks are
> associated with bot nets and phishing attacks that are linked to fast flux
> activities. These operators also bear the burden of switching the
> unauthorized traffic that phishing attacks generate and they may also incur
> the cost of diverting staff and resources to respond to abuse reports or
> legal inquiries.
>
> 5. Registrars are harmed when their registration and DNS hosting services
> are used to abet "double flux" attacks. Like Internet access providers, they
> may also incur the cost of diverting staff and resources to monitor abuse,
> or to respond to abuse reports or legal inquiries.
>
> 6. Businesses and organizations who are "phished" from bogus web sites
> hosted on fast fluxing networks may experience financial or material loss,
> tarnish to brand, or loss of customer/consumer confidence. They also incur
> the cost associated with brand abuse monitoring, detection and mitigation.
>
> 7. Individuals or businesses whose lives or livelihoods are affected by the
> illegal activities abetted through fast flux networks, as are persons who
> are defrauded of funds or identities, whose products are imitated or brands
> infringed upon, and persons who are exploited emotionally or physically by
> the distribution of images or enslavement.
>
> 8. Registries may incur the cost of diverting staff and resources to monitor
> abuse or to respond to abuse reports or legal inquiries.
>
> Who benefits from the use of short TTLs?
>
> 1. Organizations that operate highly targetable networks (e.g., government
> and military/tactical networks) that must adhere to very stringent
> availability metrics and use short TTLs to rapidly relocate network
> resources which may come under attack (Assumes the attack
> targets a dotted quad and not a FQDN.
>
> (From Joe St. Sauver: Targetting a dotted quad rather than a FQDN is
> generally preferred by intelligent attackers because then you avoid creating
> a "steerable death ray" which can be repointed by whomever controls the DNS
> for the targeted domain name)
>
> 2. Content distribution networks such as Akamai, where "add, drop, change"
> of servers are common activities to complement existing servers with
> additional capacity, to load balance or location-adjust servers to meet
> performance metrics (latency, for example, can be reduced by making servers
> available that are fewer hops from the current most active locus of users
> and by avoiding lower capacity or higher cost international/intercontinental
> transmission links).
>
> 3. Organizations that provide channels for free speech, minority advocacies,
> and activities, revolutionary thinking may use short TTLs and operate
> fast-flux like networks to avoid detection.