Cyber Security Essentials

110 Cyber seCurity essentiAls

with IP addresses of infected computers and continuously cycle new

IP addresses. Client requests for a single-flux domain received by

the domain’s name server are resolved to multiple bots (bots 1–8

in Exhibit 2-16). All requests to the domain go through infected

computers to the mothership. Acting similar to a reverse proxy, the

infected computers receive the mothership’s response to the client’s

initial request and forward it to the client. Multiple other variations

of fast-flux currently exist, and all incorporate the same techniques

with different levels of complexity. Double-flux adds a second layer

of complexity by cycling IP addresses to name servers, and hydra-

flux introduces multiple motherships.

48

Regardles ...