Subject: [weirds] Data: MS v Zeus

From: Eric Brunner-Williams <[email-masked]>
Date: Thu, 29 Mar 2012 10:40:55 -0400

colleagues,

this morning i read the complaint and appendices, 162pp, of the 3/19
filing in the eastern district of new york.

this may not be of interest to anyone other than myself, but imho
there is some relevancy.

there is a listing of "harmful domains" (with the interesting
annotation of the service primitive the zeus botherder located at
each). the summary numbers are:

1,703 domains in the .com zone (vgrs)
57 domains in the .in zone (afilias)
10 in the .asia zone (operator not identified as afilias)
334 in the .co zone (operator identified as neustar)
156 in the .biz zone (neustar)
355 in the .info zone (afilias)
165 in the .org zone (operator not identified as afilias)
433 in the .ru zone (operator identified as cc tld ru)
25 in the .tk zone (operator identified as dot tk ltd)
20 in the .tw zone (twnic)
12 in the .ua zone (operator identified as hostmaster)
6 in the .ms zone (operator identified as lubimal)
7 in the .li zone (switch)
8 in the .at zone (atnic)
4 in the .de zone (denic)
7 in the .eu zone (eurid)
2 in the .be zone (dns be)
12 in the .cn zone (neustar/cnnic)
6 in the .nl zone (sidn)
1 in the .ca zone (cira)
1 in the .la zone (operator la registry, london)
1 in the .mk zone (marnet)
1 in the .ru zone (runic)
1 in the .br zone (cgib)
1 in the .kz zone (kznic)
7 in the .ir zone (irnic)
2 in the .im zone (domicilium)
1 in the .it zone (regit)
1 in the .so zone (gmo)
2 in the .au zone (auda)
1 in the .al zone (akep)
1 in the .pl zone (nask)
1 in the .cx zone (cocca)
1 in the .ch zone (switch)

i conclude from this instance of investigation into the zeus
operator's art that reporting tools, not necessarily limited to those
which show resource allocatee data, have greater utility when querying
some resource allocators, that is, utility is not uniform.

i also conclude that the zeus operator's choice of resources to
consume reflects cost and/or complexity, that is, the allocation
policy of a resource allocator is a good guide to the utility of an
allocation reporting tool.

assuming that 80% is a useful initial threshold for automatic vs
manual processing of returns, in this sample set the 80% bogie would
be met by the following four sources (in numerical order): .com, .ru,
.info, and .co.

having eyeballed the 3k names, it appears to me that a significant
subset are strings which could not be mnemonic identifiers (other than
for persons like my autistic son, for whom arbitrary strings of
significant length are acquired, stored and recited trivially),
similar to the generated strings used by the .C conficker variant when
generating its universe of rendezvous points.

there may be other correlates.

-e

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 29 Mar 2012 10:49:03 -0400

> each). the summary numbers are:

[a list]

> some resource allocators, that is, utility is not uniform.

Was this a conclusion that was supposed to have been supported by that
list, or is it arrived at a different way?

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eric Brunner-Williams <[email-masked]>
Date: Thu, 29 Mar 2012 11:31:54 -0400

> list, or is it arrived at a different way?

(a).

-e

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 29 Mar 2012 12:23:01 -0400

> > list, or is it arrived at a different way?

Ok, thanks.  Then I genuinely don't understand.  It seemed that you
could, from the same evidence, draw conclusions about the approximate
size and commercial importance of the various domains listed.  No?

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eric Brunner-Williams <[email-masked]>
Date: Thu, 29 Mar 2012 13:24:15 -0400

> size and commercial importance of the various domains listed.  No?

in the data set prepared by the plaintiff there is what the plaintiff
alleges is a single actor (john does 1, 2 and 3, the authors of the
original zeus, ice-ix and spyeye botnets, as a merged distributed
system) and the (domain name) resources allocated by various (domain
name) allocators to the (merged) zeus botnet.

this is distinct from a random, or directed sample of domains of
interest (to someone) across a random, or directed range of name
spaces. in a random sample, volume may be the only significant
correlate -- this was the case in the .C author's selection of
registrars -- here, without mindreading, is one author's choice, as
reflected in the plaintiff's research contained in its initial pleadings.

two distinct interests are disclosed, one completely, and one
partially. the complete disclosure is that of the plaintiff's interest
-- it may not be exhaustive but it follows the distribution tail down
to singleton data points -- not stopping 80% or 99%, but going to 1 in
3,000 repeatedly. the partial disclosure is that of the zeus author,
as the plaintiff does not have complete knowledge, and may have missed
names, or incorrectly included names in any name space.

it is possible that the zeus author's resource acquisition algorithm
is size and/or commerical importance (however that is defined)
determined. n% of names in .com because .com is n% of all names, ...

it is also possible, as i suggested earlier, that the resource
acquisition is affected by the cost to acquire a unit of resource, and
the contours of systemic rational resource acquisition disclose policy
from an informed (wholesale) consumer point of view.

.C, and zeus, both appear to show cost and/or complexity to acquire
units of resource affect resource acquisition by some system authors.

-e