The Role of Hosting Providers in Fighting Command and Control Infrastructure of Financial Malware

Abstract

A variety of botnets are used in attacks on financial services. Banks and security firms invest a lot of effort in detecting and combating malware-assisted takeover of customer accounts. A critical resource of these botnets is their command-and-control (C&C) infrastructure. Attackers rent or compromise servers to operate their C&C infrastructure. Hosting providers routinely take down C&C servers, but the effectiveness of this mitigation strategy depends on understanding how attackers select the hosting providers to host their servers. Do they prefer, for example, providers who are slow or unwilling in taking down C&Cs? In this paper, we analyze 7 years of data on the C&C servers of botnets that have engaged in attacks on financial services. Our aim is to understand whether attackers prefer certain types of providers or whether their C&Cs are randomly distributed across the whole attack surface of the hosting industry. We extract a set of structural properties of providers to capture the attack surface. We model the distribution of C&Cs across providers and show that the mere size of the provider can explain around 71% of the variance in the number of C&Cs per provider, whereas the rule of law in the country only explains around 1%. We further observe that price, time in business, popularity and ratio of vulnerable websites of providers relate significantly with C&C counts. Finally, we find that the speed with which providers take down C&C domains has only a weak relation with C&C occurrence rates, adding only 1% explained variance. This suggests attackers have little to no preference for providers who allow long-lived C&C domains.

Herding Vulnerable Cats

“…Next, we move the level of analysis from individual domains to providers. In areas beyond shared hosting, researchers have repeatedly found that the intermediaries can play a key role in improving security [11,24,26,33,43,44,48,52].…”

Pythia

“…We argue that understanding the Web hosting landscape is important for a number of reasons. These range from allowing us to assess how critical certain hosting infrastructures are and to estimate the impact that a network attack could have on the Web [8,17,24], to being able to determine who is responsible when incidents (e.g., malware hosting) occur [26]. Despite the importance of the problem, the research community lacks scalable methods to map the hosting landscape.…”