Flux in Fraud Infrastructures

1
Flux in Fraud Infrastructures

• Minaxi Gupta
• Computer Science Dept.
• Indiana University, Bloomington

2
Fraud evolution

• Economically driven
• Pull vs push-based
• Much is Web-based
• Uses botnets extensively

3
Internet fraud has an infrastructure behind it

• Phishing
• Scam sites
• Drive-by downloads
• Socially-engineered malware

4
It is provisioned differently

• Flux in phishing
• Fast flux
• DNS flux
• Double flux
• Helps escape detection and promotes longevity of
  fraud

5
Observations

• 10-30 of phishing Web servers exhibit fast flux
• 60 of their DNS servers exhibit DNS flux
• Most fluxing Web servers are part of double-flux
  infrastructure
• Same machines act as Web and DNS servers in many
  cases
• One host name resolves to many IPs but many names
  share a common pool of IPs

6
Take away

• Fraud infrastructures have telltale signs
• It may be possible to create signatures that
  distinguish fraud infrastructures from regular
  Internet infrastructure
• Need to investigate what the signatures should
  look like

7
Caution

• DoS attacks do not have Web sites
• Hacked sites can be used to host fraud
• This talk takes a DNS perspective on fraud
  infrastructures
• Many by-pass DNS by using IP addresses
• Signatures in the absence of flux?
• Can criminals evolve to bypass signatures?