Domain generation algorithm
Domain generation algorithms (DGA) are algorithms seen in various families of malware that are used to periodically generate a large number of domain names that can be used as rendezvous points with their command and control servers. The large number of potential rendezvous points makes it difficult for law enforcement to effectively shut down botnets, since infected computers will attempt to contact some of these domain names every day to receive updates or commands. The use of public-key cryptography in malware code makes it unfeasible for law enforcement and other actors to mimic commands from the malware controllers as some worms will automatically reject any updates not signed by the malware controllers.
For example, an infected computer could create thousands of domain names such as: www.<gibberish>.com and would attempt to contact a portion of these with the purpose of receiving an update or commands.
Embedding the DGA instead of a list of previously-generated (by the command and control server(s)) domains in the unobfuscated binary of the malware protects against a strings dump that could be fed into a network blacklisting appliance preemptively to attempt to restrict outbound communication from infected hosts within an enterprise.
The technique was popularized by the family of worms Conficker.a and .b which, at first generated 250 domain names per day. Starting with Conficker.C, the malware would generate 50,000 domain names every day of which it would attempt to contact 500, giving an infected machine a 1% possibility of being updated every day if the malware controllers registered only one domain per day. To prevent infected computers from updating their malware, law enforcement would have needed to pre-register 50,000 new domain names every day.
Recently, the technique has been adopted by other malware authors. According to network security firm Damballa, the top 5 most prevalent DGA-based crimeware families are Conficker, Murofet, BankPatch, Bonnana and Bobax.
It can also combine words from a dictionary to generate domains using a web service through a web API.
def generate_domain(year, month, day): """Generates a domain name for the given date.""" domain = "" for i in range(16): year = ((year ^ 8 * year) >> 11) ^ ((year & 0xFFFFFFF0) << 17) month = ((month ^ 4 * month) >> 25) ^ 16 * (month & 0xFFFFFFF8) day = ((day ^ (day << 13)) >> 19) ^ ((day & 0xFFFFFFFE) << 12) domain += chr(((year ^ month ^ day) % 25) + 97) return domain
E.g., on January 7th, 2014, this method would generate the domain name
intgmxdeadnxuyla, while the following day, it would return
axwscwsslmiagfah. This simple example was in fact used by malware like CryptoLocker, before it switched to a more sophisticated variant.
- "Top-5 Most Prevalent DGA-based Crimeware Families" (PDF). Damballa. p. 4.
- Phillip Porras, Hassen Saidi, Vinod Yegneswaran (2009-03-19). "An Analysis of Conficker's Logic and Rendezvous Points". Malware Threat Center. SRI International Computer Science Laboratory. Archived from the original on 2013-02-03. Retrieved 2013-06-14.
- Lucian Constantin (2012-02-27). "Malware Authors Expand Use of Domain Generation Algorithms to Evade Detection". PC World. Retrieved 2013-06-14.
- Detecting Algorithimically Generated Malicious Domain Names
- DGAs in the Hands of Cyber-Criminals - Examining the state of the art in malware evasion techniques
- DGAs and Cyber-Criminals: A Case Study
- How Criminals Defend Their Rogue Networks, Abuse.ch