North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

the anti botnet market for ISPs and corporate networks

  • From: Gadi Evron
  • Date: Tue Sep 26 04:44:19 2006

Is here. Several companies are rehearsing their old products and
buzzwording them for DDoS mitigation or botnets, but not Trend Micro.

Trend Micro released a brand new product, implemented with the novel idea
of utilizing DNS to detect bots on an ISP or corporate network.

Whether by massive requests for a C&C (bots phoning home) or massive
requests for an MX record (spam bots), looking for negative caching (NX
being cached (as the C&C is not there yet but requested) and beyond.
It works. I don't know if that's what Trend Micro is doing, but it's one 
step in the right direction to better botnet detection and mitigation.

Larry Seltzer wrote a good article on it:
http://www.eweek.com/article2/0,1759,2020286,00.asp

This idea has been explored before:

The Domain Name Service as an IDS - NANOG archives:
http://www.irbs.net/internet/nanog/0602/0537.html
and: http://blogs.securiteam.com/index.php/archives/321

My poor choice of subject lines with quoting the paper's name
("IDS) rather than saying "better utilizing DNS to detect infeted hosts
and kill C&C's" got me a lot of flames on being off topic. It also got me
a warning on DNS being off-topic, which was withdrawn on-list.

The original paper can be found, here:
http://staff.science.uva.nl/~delaat/snb-2005-2006/p12/report.pdf
(these guys were cool enough to reference me, hehe)

Other papers were linked to from the above mentioned post.

This is pretty cool, and is worth a look. I guess we will find out what
this commercialized technology is worth now that it is out of the
home-grown/academic tools realm.

	Gadi.