Akamai Technologies, Inc. (NASDAQ: AKAM), the world’s largest and most trusted cloud delivery platform, today announced results of new research into the behavior of a malicious botnet employing Fast Flux techniques. The findings are compiled in a new white paper – Digging Deeper - An In-Depth Analysis of a Fast Flux Network.
Fast Flux, a DNS technique first introduced in 2006 and widely associated with the Storm Worm malware variants, can be used by botnets to hide various types of malicious activities – including phishing, web proxying, malware delivery, and malware communication. The technique allows the botnet to “hide” behind an ever-changing network of compromised hosts, ultimately acting as proxies and making detection incredibly difficult.
As the world’s largest Content Delivery Network (CDN) provider, Akamai has unmatched visibility into traffic flowing across both enterprise networks and the Internet. The high level of sophistication these botnets employ requires a new approach to detection. Using advanced algorithms that can distinguish between the rapidly changing malicious activity generated by these networks and legitimate traffic is key to successful detection and mitigation.
Akamai’s Enterprise Security Threat Research Team conducted an analysis of a sophisticated botnet using Fast Flux techniques made up of more than 14,000 IP addresses. Although most of the IP addresses originate from eastern Europe, some of the associated IP addresses are in address space that is assigned to Fortune 100 companies. These addresses are most likely used by this particular Fast Flux network owner as spoofed entities and are not genuine members of the network. This approach allows the botnet to “borrow” the positive reputation associated with the IP address to carry out its malicious activities.
“The increasing complexity of enterprise networks and dependencies on public networks make it more difficult than ever to maintain an accurate picture of what is really happening on your networks,” said Or Katz, Principal Lead Security Researcher, Akamai. “At the same time, the increasing sophistication of the obfuscation techniques used by hackers to hide their malicious activities makes it even more important to maintain granular insights into network activity. The level of visibility Akamai has into both ‘good’ and ‘bad’ traffic on the Internet and within corporate enterprise network makes this kind of research possible and is critically important to how we can best protect our customers.”
Akamai offerings such as Enterprise Threat Protector are designed to help organizations defend themselves against malicious botnets by identifying harmful behavior more quickly and blocking harmful interactions before they impact operations.
A complimentary copy of the white paper containing more detailed analysis of the botnet is available for download.
Mr. Katz will also be presenting his team’s findings during a session at Akamai EDGE 2017, its tenth annual customer conference, taking place October 11-13, 2017 at the ARIA Resort, Las Vegas. For a complete list of sessions, please visit the EDGE website. A list of registration rates, description of eligible attendees and conference pass options is available at EDGE Registration.
Akamai secures and delivers digital experiences for the world’s largest companies. Akamai’s intelligent edge platform surrounds everything, from the enterprise to the cloud, so customers and their businesses can be fast, smart, and secure. Top brands globally rely on Akamai to help them realize competitive advantage through agile solutions that extend the power of their multi-cloud architectures. Akamai keeps decisions, apps and experiences closer to users than anyone — and attacks and threats far away. Akamai’s portfolio of edge security, web and mobile performance, enterprise access and video delivery solutions is supported by unmatched customer service, analytics and 24/7/365 monitoring. To learn why the world’s top brands trust Akamai, visit www.akamai.com, blogs.akamai.com, or @Akamai on Twitter. You can find our global contact information at www.akamai.com/locations.