marco
blog
Menu:
A look at the Storm codec campaign's fastflux
April 29, 2008
Kind of late, but better than never I guess :-)
At the beginning of the months, the Storm gang got quite some coverage by launching a new attack campaign, based, this time, on a codec theme. Essentially, the gang tries to convince people to install a piece of malware (apparently, a NUWAR/Storm variant), by using the common social engineering trick of a missing video codec.
An interesting detail about the campaign was that it used a
fastflux domain name, i.e.,
supersameas.com. Let's take a look at its infrastructure.
On April 9, I started to query the supersameas name servers to harvest the IP addresses associated with the campaign. At each request, the name server would reply with one IP address with 0 TTL. I continued to query the server until it gave me for 30 consecutive times addresses that I had already seen. At that point, I switched to a new name server, and so on.
In total, I collected 1416 IP addresses from 405 ASes. For about 100 IPs, I could not get the corresponding AS, so what follows may be slightly skewed. The ASes with more than 20 addresses were:
- AS7132: SBIS-AS - AT&T Internet Services (105 addresses)
- AS7922: DNEO-OSP3 - Comcast Cable Communications, Inc. (46)
- AS4766: KIXS-AS-KR Korea Telecom (43)
- AS8708: RDSNET RCS & RDS S.A. (29)
- AS20214: CCCH-AS6 - Comcast Cable Communications Holdings, Inc (24)
- AS20001: ROADRUNNER-WEST - Road Runner HoldCo LLC (20)
In terms of geographical distribution, the affected ASes were in the following countries:
- Australia
- China
- Hong Kong
- Indonesia
- Japan
- Korea
- Malaysia
- Philippines
- Pakistan
- Thailand
- Taiwan
- United States
Starting on April 10 at 11:27:18 PST, I also monitored for a few days if the addresses used by the campaign were still up and running, and serving the malicious content of the campaign. The following figure shows how many sites were still compromised at intervals of one hour.
Notice that almost 75% of the hosts had already been taken down (or were otherwise unreachable) when I started the measurement. After about 12 hours, the number of live sites drops lower than 100; after other 12 hours, it is reduced by a factor of 5, down to just 21 sites. It finally reaches 1 site after some 67 hours and stays like that for at least other 3 days.
To leave a comment, complete the form below. Mandatory fields are marked *.