DNSBL, or DNS Black List, is a service for mail servers to control if the sources of received e- mails are known spammers or not. The downside of this is that the spammers use it too, to know if the bots in their Botnet are listed or not. The activity is called Reconnaissance. This is however something that can be used against them, and that is what the research by Anirudh Ramachandran, Nick Feamster and David Dagon at the College of Computing here at Georgia Tech is based upon.
The general idea is to study the query logs at the DNSBL, and from that information passively reveal the Botnets and their members. The method is passive in the sense that the botmaster cannot tell he is being watched. In that way he will not change his behavior to avoid getting caught. There are other active methods to stop Botnets, but they will not be covered here.
There are three different kinds of reconnaissance techniques:
• Third party, single host. In this technique one single host in the Botnet is responsible for making the queries for all the other bots. It is the simplest technique to implement, but also the easiest to discover.
• Self-reconnaissance. This is one way to spread out the queries among the bots by simply letting every bot make its own queries. For obvious reasons it is not a very popular technique. If a mail-server doesn’t trust its own judgment if it is a bot or not, then maybe the DNSBL shouldn’t trust it either.
• Distributed. Distributed reconnaissance is a better way of spreading out the queries among the bots. It is harder to implement, but makes it harder to discover. It means that several of the bots (maybe all) make queries about other bots.
As mentioned before, the whole idea of this method is to look at query logs to distinguish legitimate queries made by real mail-servers from reconnaissance queries made by bots. Reconnaissance queries have two major properties that differ from regular queries:
• Spatial relationship. The spatial relationship is the ratio between how many queries that are made by a server, and how many queries that are made about that same server. In the single host reconnaissance approach the number of queries made by the host will be very big, but the number of queries about the host will be zero. Because it’s not a real mail- server it will not be sending any mail, and hence there will be no queries made by others about it. For a real mail-server the ratio will be pretty even.
• Temporal relationship. The temporal relationship is decided by comparing arrival patterns for DNSBL queries with normal arrival patterns for e-mail. The number of emails arriving at different hours of the day differs in certain patterns because of office hours and other circumstances. Mail sent out by spam-bots will not necessarily follow the
queries will follow the same patterns. This could be a way to separate the reconnaissance queries from legitimate ones. It is however much harder, and the methods for doing it are still under construction.
After the reconnaissance queries have been identified they have to be analyzed. For the single host reconnaissance method the analysis is pretty straight forward. The query bots are determined by finding the hosts that have a significantly higher ratio of outgoing requests. The other bots are found by identifying which hosts the query bot is making queries about.
For the distributed reconnaissance it gets a little bit more complicated. First a small number (10- 12) of known bots has to be identified. That could be done by using a honeynet, bots in a DNSBL or maybe hosts that are queried by hosts in the DNSBL. Then a graph is created by looking at all the hosts that are queried by the known bots, and also all the hosts queried by the hosts that were queried by the bots. For all the hosts in the graph the ratio and the arrival patterns are evaluated and correlated.
When the bots are identified the DNSBL can take actions in real time. There are two proposed ways of doing this, but they both involve query response poisoning. The first is false negatives, which would be to make false responses for hosts listed in the black list - saying they were not. This would make them keep sending queries, which would reveal more bots, but it would also make them keep sending more spam which is totally against the purpose of bot fighting.
The other way would be sending false positives, which would be to make false responses for hosts not listed in the black list – saying they were. This would hopefully make them stop sending spam, but it would also make them aware that they are being watched. This would probably make them change and improve their behavior, making it harder to hunt them down.
Reference:
Revealing Botnet Membership Using DNSBL Counter-Intelligence – (Ramachandran, Feamster and Dagon, Georgia Institute of Technology, 2006)