Geolocalization of proxied services and its application to fast-flux hidden servers

Abstract

Fast-flux is a redirection technique used by cyber-criminals to hide the actual location of malicious servers. Its purpose is to evade identification and prevent or, at least delay, the shutdown of these illegal servers by law enforcement.This paper proposes a framework to geolocalize fast-flux servers, that is, to determine the physical location of the fast-flux networks roots (mothership servers) based on network measurements. We performed an extensive set of measurements on PlanetLab in order to validate and evaluate the performance of our method in a controlled environment. These experimentations showed that, with our framework, fast-flux servers can be localized with similar mean distance errors than non-hidden servers, i.e. approximately 100 km. In the light of these very promising results, we also applied our scheme to several active fast-flux servers and estimated their geographic locations, providing then statistics on the locations of "in the wild" fast-flux services.

Semantic based DNS forensics

“…Thus, the semantic field of words used in malicious words has a smaller scope than normal ones confirming that attackers targets specific services Table IV represents the value of Sim 3 between the subsets. After preliminary tests, n was set to 100 in equation (7). We can see similar scores for mal/mal and leg/leg comparisons (Sim 3 ∼ 0.95) that are higher than mal/leg (Sim 3 ∼ 0.75).…”

“…Because the main functionality provides a translation of human readable names into machine addresses, it is also used by botnets which are known, as the vector of many other attacks, to be a major threat [1]. Fast-flux [7] consists into naming a phishing website or the C&C (Command and Control) of a botnet with a unique 1 http://www.forensics-intl.com/safeback.html DNS name which points alternatively and rapidely to distinct IP addresses.…”

Server Location Verification (SLV) and Server Location Pinning

“…Geolocating fast-flux servers. Delay-based geolocation of fast-flux hidden webservers has been proposed [51]; hidden behind proxies, their IP addresses are not known to the client. When geolocating a webserver, the geolocation service provider can first detect that the webserver is hidden behind a proxy by noticing a large difference between the RTTs measured on the network layer (e.g., using ping) and the application layer (e.g., using an HTTP GET).…”

DNStamp: Short-lived trusted timestamping

“…The DNS is also used for malicious purposes. Similarly to content delivery network, fast-flux service networks rely on DNS round-robin and short TTL [9,19]. Fast-flux is used by malware to hide the location of malicious servers.…”