limiting automated domain creation by malware

Question

As we know most of the malwares create thousands of domains and subdomains using DBA for setting C&C communications. The domain names are controlled by Internet Corporation for Assigned Names and Numbers (ICANN) at the top level. Is it feasible for ICANN to ask all registrars for integration of OTP (One time Password) for domain registrations. Which means for each domain registration , the registrar would send a OTP to a mobile and domain will get registered only after OTP authentication. This should put limits on automated domain registrations as well as can provide a trace to registered mobile number. Is this feasible to implement ?

Answer 1

I'm not sure you've quite understood how DGA implementing malware works. It doesn't actually register the domain names - it just generates them, and attempts to contact a subset of them.

The malware author can generate the same list, and pick one or two to register, and then the malware may connect to the registered ones in attempted to update - this usually isn't a certainty. For example, according to Wikipedia, Conficker.c generated 50,000 domain names per day, then attempted to access 500 of these (e.g. 1%), looking for a specific response. The malware author would only need to register 1 of those 500 to be able to update, which wouldn't be arduous, even with a OTP scheme as suggested.

This wouldn't give any certainty that a given instance of the malware would be updated on a given day, but given a long enough infection period, and a widely spread malware distribution, enough instances are likely to be updated to continue to cause problems.

What could be feasible would be for a domain registrar to prevent registration of any domain generated within known malware. However, this would probably encourage malware authors to adopt different techniques - perhaps by checking whether a domain can be registered, and activating if not.

Answer 2

Your proposed solution is not likely to work on multiple fronts.

Is it feasible for ICANN to ask all registrars for integration of OTP (One time Password) for domain registrations.

I've been dealing with mitigating a particular threat involving abuse of OTPs for over a year now. You don't seem to realize just how many burner phone services there are out there (prepaid, etc) as well as disposable VoIP solutions (Google Voice, etc), all of which can be set up as part of an organized ring or completely automated with a simple Python script (as @Martin Fischer posits). And then there are the phones stolen and used for OTP validation before the owner catches on and deactivates it.

This should put limits on automated domain registrations as well as can provide a trace to registered mobile number.

It would certainly hamper automated domain registration to an extent but it's still the sort of work you could field out to a Nigerian call center for pennies an hour. And don't kid yourself that the registered numbers ever lead anywhere, especially when international borders are involved.