Re: (no subject)

Laird commented:

#On Mar 14 2004, Carl Hutzler wrote:
#> Ahhh, your last point is very true. But for some reason they don't yet 
#> seem to use "reverse" proxy-bots that way, that much. I mean I have seen 
#> the proxies used in the reverse manner, but for some reason it is 
#> currently unattractive.
#
#It's likely to be less reliable, too, I should think. Users don't
#leave their machines on the net 24/7, although with broadband on the
#uptake, there probably is a critical mass of machines that are always on.

Actually, there are reverse proxy bots in routine use today. Migmaf is the 
canonical example; see: http://www.lurhq.com/migmaf.html

We've seen (literally) tens of thousands of compromised hosts involved with
that one exploit. 

There are enough infested hosts, and the agents on those hosts are smart 
enough to report their connectivity, so effective reliability isn't a
material issue as far as I can see. 

(Of course, because the agents on the infected hosts "phone home," 
it is trivial to intercept the stream of owned hosts if you have access 
to one or more of the magic potential C&C hosts. (see the discussion of the
Migmaf "combination lock" IP address construction technique at
http://www.symantec.com/avcenter/venc/data/backdoor.migmaf.html -- note,
too, that since 78.0.0.0/8 a reserved range, you're really only looking
at 2x3x3x3=54 potential command and control hosts, not exactly an 
impossible number of hosts to investigate or instrument). 

But you don't need to be able to watch the traffic stream to the command
and control host to spot and whack the Migmaf hosts are actually in use --
we routinely track a variety of FQDNs that use this technique using code
that we developed locally that simply queries and tracks the FQDN's these 
guys use. Or heck, you can spot 'em using nslookup:

% nslookup www.valuedsoft.biz
Non-authoritative answer:
www.valuedsoft.biz      canonical name = valuedsoft.biz.
Name:   valuedsoft.biz
Address: 66.192.164.100 <-- uw2-164-100.dmisi.cust.twtelecom.net
Name:   valuedsoft.biz
Address: 67.36.187.245  <-- adsl-67-36-187-245.dsl.chcgil.ameritech.net
Name:   valuedsoft.biz
Address: 67.70.0.7      <-- Toronto-HSE-ppp3855380.sympatico.ca
Name:   valuedsoft.biz
Address: 68.56.28.222   <-- pcp03209554pcs.venice01.fl.comcast.net
Name:   valuedsoft.biz
Address: 62.167.94.37   <-- adsl-62-167-94-37.adslplus.ch

[We're happy to share the code we run to track these hosts with NSPs who 
may want to whack abused customer hosts in near-real-time.]

I should also mention that increasingly even the name servers for 
spamvertised domains are being handled via reverse proxies, too. :-;

Regards,

Joe