Home / Blogs

Microsoft's Takedown of 3322.org - A Gigantic Self Goal?

Suresh Ramasubramanian

I will first begin this post by emphasizing that this article is entirely my personal viewpoint and not to be considered as endorsed by or a viewpoint of my employer or any other organization that I am affiliated with. Neither is this to be considered an indictment of the sterling work (which I personally value very highly) that several people in Microsoft are doing against cybercrime.

Microsoft's takedown of 3322.org to disrupt the Nitol botnet is partial (3322 is not the only dynamic DNS provider Nitol uses) and will, at best, have a temporary effect on the botnet itself, as Damballa's Gunter Ollmann says in a previous CircleID post. Brian Krebs goes into much more detail on just how partial this takedown is, in his blog post.

This is the second such recent high profile takedown by Microsoft — the last one was a takedown of several domains used by the Zeus botnet, which is still alive and well, after a temporary dip because of the takedown.

Microsoft's Terry Zink, who I have a lot of respect for and consider a good friend whose comments on security issues I particularly value, has a balanced article posted earlier on CircleID where he argues the merits of this takedown, and makes a cogent case for the Microsoft strategy of "disrupt, disrupt, disrupt".

Terry's post also quotes Arbor's Jose Nazario, who points out, correctly, that such takedowns must be comprehensive to root out the botnet, and also need to be backed by arrests to ensure that the disruption is complete. Jose, as another expert with decades of experience on the front lines of internet security, is entirely correct here.

In this 3322 takedown though, Microsoft has crossed a significant line in their enforcement actions.

They have not disrupted Nitol by taking over a domain that was registered by a cybercriminal and exclusively used to provide command and control for the botnet. They have taken over a dynamic DNS provider, admittedly one with a massive infestation of cybercriminals and a history of lackadaisical abuse prevention (which tends to attract even more spammers and botmasters), but which has millions of legitimate chinese users.

A dynamic DNS service is what you tend to use if, for example, you need remote access to a webcam, playstation or similar device that's on your home network, connected over a dynamic IP broadband connection. Legitimate traffic to these webcams and such will ideally not be disrupted by Microsoft's taking over 3322.org DNS and proxying DNS requests back to 3322 for hostnames other than those that it deems malicious.

However, individual users and small businesses do use 3322.org and similar dynamic DNS providers to run mailservers on broadband lines. 3322.org's actual use cases (based on their product offering) appear geared to home users, who want a hostname that will provide them fast and load balanced external access to devices in their home, and let a small business run a mailserver on a static IP broadband line while outsourcing their DNS to 3322.

3322's website says that their service is named "PubYun" — which is suggestive of what they see their service as. "Yun" is chinese for "Cloud" and they see their DNS service as helping their customers get a cheap "public cloud".

The collateral damage from this seizure means that 3322's public cloud has been disrupted for potentially millions of legitimate users, none of whose traffic goes anywhere at all near microsoft.com or is any way related to Nitol or other botnets.

While ns*.microsoftinternetsafety.net, which Nominum operates for Microsoft to proxy this siezed domain, proxies A record lookups to 3322's nameservers, it returns a SERVFAIL when it gets a query for, say, an MX record for a 3322 hostname. This means that people who use a 3322.org hostname for their email (and they do exist) need to change their email addresses.

As Krebs points out, 3322 is actively helping their customer base that's affected in any way by this seizure to migrate out to other DNS names. Which means that there is substantial collateral damage which 3322's support team is helping to address by providing alternate hostnames to affected users.

Still, in Microsoft's defense, 3322 has, over the past several years, had a massive infestation of cybercriminals creating and cycling through thousands of hostnames for botnet command and control, spam and other malicious activity.

3322 has been unresponsive to complaints, and where they don't take action, there does need to be some community action to defend itself against this unchecked malicious traffic.

If this action had extended merely to blocking 3322 on Microsoft's corporate infrastructure and websites that it controls that were targeted by bots with command and control on 3322 hostnames, that'd have been fine, and perfectly justified. If antivirus or spam filter providers were to tag URLs and traffic related to 3322.org as potentially malicious, that too might be quite easily justifiable.

Before it comes to takedown —

Did Microsoft reach out to other Chinese organizations to mitigate Nitol?

Did Microsoft try to work with 3322.org's upstream internet providers etc? And if (as I suspect) they did not respond appropriately, did they contact the Chinese CERT to see if they could take action?

Though, as China has historically had a lot of bot activity over the past several years, I am not entirely sure that CN-CERT has been quite as effective as one would expect a national CERT to be. However China has a massive problem with botnets and presumably CN-CERT's resources and reach are limited and not quite capable of sufficiently dealing with this issue?

Previous indications (such as in this article about their lack of timely response to some SCADA malware) suggest that they receive thousands of emails a day and may lack the staff to process those emails and act on them in a timely fashion.

So, to be charitable, let me assume that Microsoft has tried these options and failed to get any actual results from them.

Now, what are Microsoft's goals in this takedown?

Quick results (and yes, lots of headlines in the newspapers) as in the partial takedown of Zeus by siezing and sinkholing a few of its domain names while leaving a large part of Zeus' command and control infrastructure untouched, providing active scope for the criminals behind Zeus (free and un-arrested) to work around this siezure?

There's a similar pattern in this new partial takedown of Nitol (which uses a bunch of other chinese dynamic DNS providers, who have more or less equally patchy records on abuse mitigation and just as large a cybercrime problem as 3322 does).

So, in the medium to long term run, all that Microsoft DCU and Mr. Boscovitch have achieved are laudatory quotes in various newspapers and a public image as fearless and indefatigable fighters waging a lone battle against cybercrime.

That manifestly is not the case. There are several other organizations (corporations, independent security researchers, law enforcement across several countries) that are involved in studying and mitigating botnets, and a lot of their work just gets abruptly disrupted (jeopardizing ongoing investigations, destroying evidence and carefully planted monitoring).

Some of them allege, as did Fox-IT's Michael Sandee, that Microsoft's court filings also contain "some of the nicknames, email addresses, and instant messaging handles about the John Does allegedly involved in this cybercrime group that is identical to information it (meaning Fox-IT) had provided under nondisclosure to a specific mailing list."

The seized domains in the Zeus takedown included domains that had been set up by various researchers and law enforcement as sinkholes to monitor the botnet — infrastructure that had to be painfully rebuilt from scratch after the takedown suddenly disrupted it without a word of warning to the security community at large.

Sandee is quite correct that there is a much larger community of people and organizations involved in this, and takedowns ought to be coordinated, and informally communicated on a need to know basis with enough stakeholders that any potential pitfalls can be avoided. Investigations need not be disrupted, and massive collateral damage (as was caused by Microsoft and Nominum's failure to proxy anything other than A records) might have been avoided.

Taking botnet threats down the way the Conficker Working Group has, in the past, with global coordination, is much more effective — comprehensive, and truly surgical in scope (Microsoft's 3322 takedown was about as surgical as a fire ax is).

Except that such initiatives just don't generate the sort of wildly laudatory press coverage that Microsoft's PR department is capable of generating, to cast it as something in the mould of the Lone Ranger or the Batman — mask, secret identity and underpants worn outside the costume an optional extra.

In the golden age of the DC comicsverse, the role of the police is limited to switching the bat signal on, and carting the Joker or the Penguin off to Arkham Asylum at the end of the episode, and the general public is there solely to provide appropriate background noises (squeals of fear, applause ...).

In the real world of botnet mitigation, not coordinating with the security community at large is a major mistake and it has led to, in both the Zeus and Nitol cases, a partial, botched takedown, and a non trivial amount of collateral damage.

Another of my good friends and longtime CircleID poster Wout deNatris suggests a model for effective public private cross border coordination in such takedown actions. Other security practitioners, such as from the Honeynet Project, have proposed a code of conduct for such takedowns, that stresses multistakeholder cooperation and maintaining confidentiality.

Neither of these models appear to suit Microsoft DCU's current strategy of quick, high profile takedowns of a few domains, coupled with a publicity blitz that makes it sound like Nitol and Zeus have been buried with a stake through their hearts (though that interpretation might be one that individual reporters have, rather than one that Microsoft explicitly gives them).

This strategy of partial, high profile takedowns, coupled with a cavalier disregard for coordination with other stakeholders, is ultimately harmful to botnet mitigation.

It makes the botnets more resilient and future generations of botnets will cope much better with partial disruption. An analogy would be the way that taking antibiotics to cure Tuberculosis, but not following the recommended dosage has caused the TB bacteria to develop resistance to the antibiotics they're commonly treated, resulting in the development of extensively drug resistant (XDR) tuberculosis that needs treatment with yet more powerful antibiotics, to which it may develop even further resistance.

It makes the security community at large begin to distrust Microsoft and be wary of sharing confidential information even with those stakeholders from Microsoft that it has worked constructively with in the past. Especially confidential information involving botmasters, gained undercover, which can, if rashly disclosed in public court filings, potentially disrupt other active investigations, or worst case, pose a threat to the lives of various computer security and law enforcement people who have infiltrated the botnet.

Still further, it bolsters the claims of nations like China who are pressing for an end to US control of substantial parts of the Internet including the root servers, ICANN and IANA.

Of course, .org, as a gTLD controlled by a US based organization (PIR), is at a level below that at which China and other nations support international control and regulation of the Internet. My concern is that this incident will possibly lead to expansion of the scope of just what is demanded to be brought under international control and regulation, especially with the ITRs coming up for modification at the WCIT in Dubai later this year.

I will conclude this article by asking Microsoft's DCU and Mr. Boscovitch personally whether they really have thought through all the implications of their continuing to play a lone hand in this game. Microsoft is a valuable stakeholder in international cybercrime enforcement, and it would be excellent to see them contribute constructively in this area rather than prefer their current course of action which trades limited short term gains and massive publicity for longer term, possibly permanent damage to international cooperation against cybercrime.

By Suresh Ramasubramanian, Architect, Antispam and Compliance

Related topics: Cloud Computing, Cybercrime, DNS, DNS Security, Domain Names, Registry Services, Internet Governance, Malware, Policy & Regulation, Security, Top-Level Domains

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

The silence on circleid about this article has been deafening .. Suresh Ramasubramanian  –  Sep 19, 2012 3:17 AM PDT

.. in total contrast with all the discussions I've been having with various people who read my article and emailed me privately to comment.  Naming no names at all and just summarizing a couple of common points that various people sent me feedback about.  I'll add my comments below.

** 3322.org had an extremely large infestation of botnets, and international cooperation against cybercrime is extremely slow, especially in the case of initiating prosecutions.

[srs] True. Except that the collateral damage involved in taking down a provider that also has legitimate customers is extremely high.  I was not this scathing about the previous (Operation b70) takedown by Microsoft of several domains used by the Zeus botnet. 

** What else might have been done?  Publicity is inevitable when a botnet is taken down, and botnets always grow back into place after takedowns, though the chances of a botmaster being arrested are few and far between, so "arrest, arrest, arrest" is not always a feasible approach.

[srs] Constructive engagement with other stakeholders in the security community would have helped in this case because -

1. There would be a much wider feed of botnets that could be disabled by sinkholing parts of 3322.

2. Additional targets along with 3322 might have been identified for mitigation

3. Contacts within China might have been escalated to, to see if any other people in the community had trusted contacts

4. If siezing and sinkholing the domain through a court order was the only feasible way forward, this could at least have been done more carefully (for example 3322 hosts with MX records would have been handled appropriately)

So, my objection in this case is not as much the sinkholing of 3322 (though from a internet governance perspective, it has occured at an unfortunate time, to say the least), as it is the lack of coordination with the security community, resulting in several gaps in the implementation of this sinkhole and unnecessary collateral damage

Backlink The Famous Brett Watson  –  Sep 20, 2012 6:45 AM PDT

Just FYI, this article has been cited by Brian Krebs in his commentary on the subject.

Backlink #2 - on the sinkholing of Nitol [etc] affected machines Suresh Ramasubramanian  –  Sep 21, 2012 12:23 AM PDT

http://blog.threatstop.com/2012/09/21/nitol-takedown-how-threatstop-can-help-identify-affected-machines/

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

General Availability Period for New .RED Top-Level Domain Opens

General Availability Period for New .BLUE Top-Level Domain Opens

General Availability Period for New .PINK Top-Level Domain Opens

New Chinese "Mobile" Top-Level Domain Now Available

New .KIM Domain Goes Live

Welcome .SHIKSHA! General Availability Now Open

Adrian Kinderis Appointed as Chair of Domain Name Association

Internet Reaches 271 Million Domain Names in the Fourth Quarter of 2013

Why We Decided to Stop Offering Free Accounts

Internet Business Council for Africa Participates at the EU-Africa 2014 Business Forum, Brussels

The Future of Chinese Domain Names (a Panel Discussion)

dotStrategy Selects Neustar's Registry Threat Mitigation Services for .BUZZ Registry

Tony Kirsch Announced As Head of Global Consulting of ARI Registry Services

24 Million Home Routers Expose ISPs to Massive DNS-Based DDoS Attacks

Afilias Chairman Appointed to Domain Name Association Board

.BUILD Enters Landrush with Support of ARI Registry Services

Dyn Acquires Managed DNS Provider Nettica

Radix Awards Contracts for .website, .host, .space, and .press to CentralNic plc

DotConnectAfrica Statement Regarding NTIA's Intent to Transition Key Internet Domain Name Function

Afilias Welcomes "Dot Chinese Online" and "Dot Chinese Website" Top-Level Domains to the Internet

Sponsored Topics