[gnso-ff-pdp-may08] Data from Arbor Networks

["Mike O'Connor" <mike@xxxxxxxxxx>]

Many thanks to Joe St Sauver for putting me in touch with Jose 
Nazario of Arbor Networks.  "Arbor Networks is a leading provider of 
secure service control solutions for global networks. Arbor's 
customers include over 70 percent of the world's ISPs and many large 
enterprises. By providing unmatched network-wide visibility, Arbor 
solutions deliver best-in-class network security, traffic management, 
network monitoring, bandwidth management and broadband service 
optimization " (from their web site).
Jose has offered to help us out on the fact-gathering front.  here's 
his email, responding to some very general questions that I just 
posed to him.  I wanted to share this with the group as a great 
example of a helpful partnership and resource.   Many thanks Jose!
I asked Jose whether these numbers are a good representation of the 
total numbers, or are they sub-totals (based on the networks that 
they're monitoring).   He says it's independent of their sensors.  He 
goes on to say that they get candidate domains from an internal spam 
feed, malcode URLs and a few blacklists.  They screen for "fluxy" 
characteristics and then track the live ones.
Here's a presentation to FIRST (last month) that he shared with 
me.  I found it very interesting, all the way from data-presented to 
issues that we're charged with looking into.  Worth the read IMHO;
http://monkey.org/~jose/presentations/first08.d/ATLAS%20Fastflux%20NSM-SIG.pdf

Here's his email response to my broadly-framed questions (I promised 
him that our questions would get more carefully-crafted);

> Date: Mon, 14 Jul 2008 14:39:22 -0400 (EDT)
> From: Jose Nazario <jose@xxxxxxxxx>
> To: Mike O'Connor <mike@xxxxxxxxxx>
> cc: Joe St Sauver <joe@xxxxxxxxxxxxxxxxxx>
> Subject: Re: fast flux data for ICANN
> X-Antivirus: AVG for E-mail 8.0.138 [270.4.10/1551]
>
> On Mon, 14 Jul 2008, Mike O'Connor wrote:
>
> > - the scale and scope of fast-flux activities (ie, what percent of IP
> >   addresses, and what percent of domain-names are used for fast-flux?)
> ATLAS measures fast flux botnet membership via active polling of the 
> domain names. that said, ATLAS sees ~3000 unique IPs for those 
> addresses every 24 hours or so.
> ATLAS is currently tracking ~6400 fast flux domain names.
>
> both values are sub 1% for their entity class. even if we're off by 
> a reasonsable factor of 10 it's just not a "big" problem in terms of 
> populations.
> active polling gives us between 1 and 5 % botnet visibility for 
> botnets using fast flux (a small minority of all botnets) when we 
> compare actve botnet measurements vs DNS-based methods.
> > - the impact of fast flux (how many networks, businesses, etc. suffer
> >   harm -- and what kind of harm)
> there are at least two sides to the "harm" question: infected 
> machines participating in the fast flux network and victims who 
> click the links to go there (ie folks lured in by the storm worm 
> campaigns). the latter is well measured by various groups. the 
> former is something we can eastimate in ATLAS.
> here's top 20 ASNs by infected bot count in the past 24 hours:
>
>     150 | AS7132 SBIS-AS - AT&T Internet Services
>     121 | AS8708 RDSNET RCS & RDS S.A.
>     117 | AS8402 CORBINA-AS Corbina Telecom
>      88 | AS9121 TTNET TTnet Autonomous System
>      72 | AS5617 TPNET Polish Telecom's commercial IP network
>      57 | AS8997 ASN-SPBNIT OJSC North-West Telecom Autonomous System
>      53 | AS13184 HANSENET HanseNet Telekommunikation GmbH
>      50 | AS8615 CNT-AS CNT Autonomous System
>      50 | AS8551 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone
>      50 | AS4766 KIXS-AS-KR Korea Telecom
>      47 | AS9304 HUTCHISON-AS-AP Hutchison Global Communications
>      47 | AS12714 TI-AS NetByNet Holding
>      43 | AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone
>      43 | AS3209 Arcor IP-Network
>      36 | AS9829 BSNL-NIB National Internet Backbone
>      36 | AS6830 UPC UPC Broadband
>      36 | AS1680 NetVision Ltd.
>      32 | AS6746 ASTRAL ASTRAL Telecom SA, Romania
>      32 | AS3320 DTAG Deutsche Telekom AG
>
>
> none of these stand out as a big corporation like microsoft or GM 
> (as opposed to consumer broadband).
> based on these numbers i would say the scale of the problem just 
> based on populations is small.
> i think there is more to it than that, including dollar values, 
> stress on the infrastructure, facilitating spam and fraud, etc.
> -------------------------------------------------------------
> jose nazario, ph.d.     <jose@xxxxxxxxx>
> security researcher, office of the CTO,  arbor networks
> v: (734) 821 1427             http://asert.arbornetworks.com/