Re: (no subject)

Neat stuff.

We are nailing both the IP address and the URL domain for these systems. 
At least if we go after the URL domain they have to buy another one.

-Carl

[email protected] wrote:

>Laird commented:
>
>#On Mar 14 2004, Carl Hutzler wrote:
>#> Ahhh, your last point is very true. But for some reason they don't yet 
>#> seem to use "reverse" proxy-bots that way, that much. I mean I have seen 
>#> the proxies used in the reverse manner, but for some reason it is 
>#> currently unattractive.
>#
>#It's likely to be less reliable, too, I should think. Users don't
>#leave their machines on the net 24/7, although with broadband on the
>#uptake, there probably is a critical mass of machines that are always on.
>
>Actually, there are reverse proxy bots in routine use today. Migmaf is the 
>canonical example; see: http://www.lurhq.com/migmaf.html
>
>We've seen (literally) tens of thousands of compromised hosts involved with
>that one exploit. 
>
>There are enough infested hosts, and the agents on those hosts are smart 
>enough to report their connectivity, so effective reliability isn't a
>material issue as far as I can see. 
>
>(Of course, because the agents on the infected hosts "phone home," 
>it is trivial to intercept the stream of owned hosts if you have access 
>to one or more of the magic potential C&C hosts. (see the discussion of the
>Migmaf "combination lock" IP address construction technique at
>http://www.symantec.com/avcenter/venc/data/backdoor.migmaf.html -- note,
>too, that since 78.0.0.0/8 a reserved range, you're really only looking
>at 2x3x3x3=54 potential command and control hosts, not exactly an 
>impossible number of hosts to investigate or instrument). 
>
>But you don't need to be able to watch the traffic stream to the command
>and control host to spot and whack the Migmaf hosts are actually in use --
>we routinely track a variety of FQDNs that use this technique using code
>that we developed locally that simply queries and tracks the FQDN's these 
>guys use. Or heck, you can spot 'em using nslookup:
>
>% nslookup www.valuedsoft.biz
>Non-authoritative answer:
>www.valuedsoft.biz      canonical name = valuedsoft.biz.
>Name:   valuedsoft.biz
>Address: 66.192.164.100 <-- uw2-164-100.dmisi.cust.twtelecom.net
>Name:   valuedsoft.biz
>Address: 67.36.187.245  <-- adsl-67-36-187-245.dsl.chcgil.ameritech.net
>Name:   valuedsoft.biz
>Address: 67.70.0.7      <-- Toronto-HSE-ppp3855380.sympatico.ca
>Name:   valuedsoft.biz
>Address: 68.56.28.222   <-- pcp03209554pcs.venice01.fl.comcast.net
>Name:   valuedsoft.biz
>Address: 62.167.94.37   <-- adsl-62-167-94-37.adslplus.ch
>
>[We're happy to share the code we run to track these hosts with NSPs who 
>may want to whack abused customer hosts in near-real-time.]
>
>I should also mention that increasingly even the name servers for 
>spamvertised domains are being handled via reverse proxies, too. :-;
>
>Regards,
>
>Joe
>  
>