Who is harmed by fast flux activities?
1. Individuals whose computers are infected by attackers and subsequently used to host name servers or web sites for a fast flux phishing attack. The individual may have his Internet connection blocked. In the extreme, should the computer be suspected of hosting illegal material, the computer may be seized by law enforcement agents (LEAs) and the individual may be subjected to a criminal investigation.
2. Businesses and organizations whose computers are infected may have Internet connections blocked, which may result in loss of connectivity for all users as well as the possible loss of connectivity for any Internet services also hosted via the blocked connection (e.g., mail, web, e-merchant or ecommerce sites). Again, in the extreme, should the computer be suspected to host illegal material, the computer may be seized by LEAs and the individual may be subjected to a criminal investigation. If this computer were hosting web and other services for the business/organization, the seizure could also result in an interruption of service, loss of income or "web presence".
3. Individuals who receive phishing emails and are lured to a phishing site hosted on a bot used by the miscreants/criminals who run the phishing attack may have their identities stolen or suffer financial loss from credit card, securities or bank fraud. They may unwittingly disclose medical or personal information that could be used for blackmail or coersion. They may infect their computers with malicious software that would "enlist" their computers into a bot herd. Individuals who purchase bogus products, especially pharmaceuticals, may be physically harmed from using such products.
4. Internet access operators are harmed when their IP address blocks are associated with bot nets and phishing attacks that are linked to fast flux activities. These operators also bear the burden of switching the unauthorized traffic that phishing attacks generate and they may also incur the cost of diverting staff and resources to respond to abuse reports or legal inquiries.
5. Registrars are harmed when their registration and DNS hosting services are used to abet "double flux" attacks. Like Internet access providers, they may also incur the cost of diverting staff and resources to monitor abuse, or to respond to abuse reports or legal inquiries.
6. Businesses and organizations who are "phished" from bogus web sites hosted on fast fluxing networks may experience financial or material loss, tarnish to brand, or loss of customer/consumer confidence. They also incur the cost associated with brand abuse monitoring, detection and mitigation.
7. Individuals or businesses whose lives or livelihoods are affected by the illegal activities abetted through fast flux networks, as are persons who are defrauded of funds or identities, whose products are imitated or brands infringed upon, and persons who are exploited emotionally or physically by the distribution of images or enslavement.
8. Registries who may incur the cost of diverting staff and resources to monitor abuse or to respond to abuse reports or legal inquiries.
Who benefits from the use of short TTLs?
1. Organizations that operate highly targetable networks (e.g., government and military/tactical networks) that must adhere to very stringent availability metrics and use short TTLs to rapidly relocate network resources which may come under attack.
2. Content distribution networks such as Akamai, where "add, drop, change" of servers are common activities to complement existing servers with additional capacity, to load balance or location-adjust servers to meet performance metrics (latency, for example, can be reduced by making servers available that are fewer hops from the current most active locus of users and by avoiding lower capacity or higher cost international/intercontinental transmission links).
3. Organizations that provide channels for free speech, minority advocacies, and activities, revolutionary thinking may use short TTLs and operate fast-flux like networks to avoid detection.
