Is your smart fridge a traitor? Could it be that it no longer just texts you when you run out of milk, but has been recruited into a zombie network (botnet)? The CRTC (Canadian Radio-television and Telecommunications Commission) plans to block botnet traffic by applying measures that “strike a balance between effectiveness and ease of implementation” without imposing additional costs on subscribers. An overview of the methods used by operators shows this will be anything but easy.
The federal body responsible for regulating telecommunications proposes giving Internet service providers (ISPs) the mandate to filter botnet traffic. It is in this context that, until March 15, it is holding a call for comments. This blocking is meant to prevent communication between the infected devices that make up the botnet and their command and control server (C2 server). This filtering could take several forms. The CRTC’s call mentions “domain-based blocking, Internet Protocol (IP)-based blocking, and protocol-based blocking.”
The domain name is the name of the website we type into a browser’s address bar, such as “hackfest.ca,” for example. This domain name is then translated into an IP address by domain name resolvers (DNS).
“Domain-based blocking” involves creating and continuously updating a list of domain names to block. “Internet Protocol (IP)-based blocking” amounts to creating a similar list, but for IP addresses. To prevent abuse, the CRTC suggests that “an independent party specializing in cybersecurity” be responsible for the framework. That party would be able to approve additions to these lists.
Changing addresses to avoid detection
The obfuscation techniques used by botnet operators make applying these techniques extremely difficult. Indeed, as described in a review of the scientific literature published in 2017 (Botnet detection technology based on DNS, Xingguo Li et al., 2017), botnets use a method called “domain flux” to thwart detection attempts. This method allows botnets to constantly change the names of their C2 servers. Algorithms are used to generate multiple domain names pseudo-randomly. According to the authors of this article, keeping the list of these domains up to date would require an enormous amount of resources.
We run into the same problem when trying to block IP addresses. The “fast flux” technique is used to assign multiple IP addresses to the same domain name. In a variant called “double flux,” the zombies do not communicate directly with the C2 server, but with an intermediate layer of devices acting as relays. This configuration provides more resilience by isolating the core of the botnet.
The risk of false positives
Other factors increase what are known as “false positives” (the risk of blocking a domain name or IP address that is not malicious).
There are legitimate reasons to use botnet networks. These are not made up of devices infected without their owners’ knowledge, but they use a similar architecture. They are used for crawling the web (“web scraping”), by penetration testing teams (“red team”) and for other automation processes.
An article by the firm Fireeye sums up these difficulties well.
- Botnet developers use legitimate websites to host their code. It may be that a single document on such a site is used by the botnet for criminal purposes. Blocking the domain will not only block the zombies, but also legitimate access to the infected website.
- Operators use platforms such as Twitter, Amazon Cloud Services and other public hosting services. Blocking these services entirely is inconceivable.
- IP addresses, once abandoned by botnet operators, are used by legitimate sources that end up on blocklists.
- The Fireeye article also mentions the use of P2P (peer-to-peer) protocols. These botnets do not use C2 servers, rendering mechanisms for blocking them obsolete.
Faced with the botnet threat, the CRTC has expressed its desire to find a solution that is easy, effective and does not impose additional costs on Internet subscribers. An overview of the technologies used by botnet operators seems to indicate that a solution to this problem will be anything but easy.
photo credit: Melissa Mathies - CC license
