Botnet

 

그림출처 : http://resources.infosecinstitute.com/botnets-and-cybercrime-introduction/

 

보통 bonet하면 C&C서버가 있는 centralized 방식인 왼쪽그림과 같다. 근데 C&C server가 single point failure도 되고 이런저런 문제가있어서 오른쪽과 같은 P2P방식으로 진화됨.....

method : bot들은 their neighbor밖엔 모른다. 기존의 P2P algorithm을 그대로 쓰기때문에 구분이안됨..

단점 : large scale attack에는 힘들다. P2P기술이 <50peers정도의 소규모만 가능하게 때문에..

fast flux

C&C server주소를 알아내기 위해 DNS를 사용한다. 그래서, client가 domain name을 알고있더라도 접속하는 대상의 실체를 제대로 알지 못한다.

Today, Fast Flux Service Networks constitute a major threat for Internet users. Fast Flux is a sophisticated technique that associates a public domain name to a set of malware-infected hosts (flux agents) that changes rapidly, potentially at every DNS query. Each flux agent typically acts as an intermediary (proxy) between victim user and the actual source of malicious content, also known as mothership. Cyber-criminal organizations routinely employ the fast flux archi- tecture to diffuse malware and support any kind ofscam, such as phishing, malicious adult websites, gaming and pharmacy scams.

Since a single malicious domain name may resolve to thousand of hosts scattered around the world,

사진출처 : https://pralab.diee.unica.it/en/WebSecurity