Update to Microsoft Takedown – Domains Fully Restored

Re:Update to Microsoft Takedown – Domains Fully Restored by Guvante on Monday July 07, 2014 @12:42PM (#7999726)

I haven't seen heavy technical details on what the seizure involved, but if in theory they got a hold of some control domains they could have sent out kill commands to stop the malware from working or alternatively sent them to a static "do nothing" host.

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by ntakasaki on Monday July 07, 2014 @01:45PM (#8000126)

According to one researcher who reports malware to hosts, the bad guys keep adding hundreds of new subdomains every hour.

http://blog.unmaskparasites.com/2009/09/11/dynamic-dns-and-b...

>However since hackers add new domain names every hour, 100+ new hostnames need to be blocked. I’ve sent a few updates to both services, but they haven’t yet responded and I guess we’ll need to wait until Monday when they get back to work.

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by dublinben on Monday July 07, 2014 @03:53PM (#8000983)

Is there a reason why they are relying on DDNS to resolve IP addresses, instead of simply using the resulting IP addresses themselves? It seems like relying on No-IP here was a clear weak point in the design of this malware.

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by nucleardog on Monday July 07, 2014 @10:38PM (#8002762)

How do you distribute the new IP address to members of the botnet even in the face of an unclean disconnection of a current C&C server?

You could maintain a list of backup C&C servers on every node and see what happens, but you risk a netsplit causing your botnet to fragment.

Or, you just have a centralized place to list the authoritative address of the current master.

But you don't want to host that yourself - that's a link back to you.

Another commenter mentioned the botnet was creating hundreds of new subdomains every hour. Obviously they had found a way to automatically register new accounts, and they had tens or hundreds of thousands of IP addresses to register from... By hosting it on a well-known and well-used service, they created a situation where someone is basically forced to take the entire service offline or take other drastic measures in order to counter-act them.

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by dublinben on Tuesday July 08, 2014 @10:21AM (#8004623)

Good point. I just figured they might have preferred to run their own DDNS service, or use p2p, since as we've seen, a service as large as No-IP can be completely shut down in a situation like this.

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by nucleardog on Wednesday July 09, 2014 @09:20PM (#8013108)

It can be shutdown, but with a lot more difficulty than just getting some random server somewhere used only for the botnet pulled offline, which was probably the point, really.

If I were a malware author I would never have assumed anyone could have gotten a court order to take an entire service offline.

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by justsomedood on Monday July 07, 2014 @05:43PM (#8001662)

I'm sure they're using compromised hosts for the servers, which would change pretty often

[ Parent | on HN ]

Re:Update to Microsoft Takedown – Domains Fully Restored by superuser2 on Tuesday July 08, 2014 @02:59PM (#8006093)

Maybe because the C&C servers were not (all) servers, but hosted on people's residential connections?

[ Parent | on HN ]