Malware creators are using DNS requests for data exfiltration. How do these attacks work, and what are the best...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
ways to defend against them?
Advanced attackers have been using DNS tunnels, ICMP tunnels, among others, for many years. Due to their successes, many other attackers have also adopted the technique, leading to its rise in popularity. DNS has also typically been allowed to connect outbound to the Internet without filtering, allowing attackers to use it to tunnel data out of compromised networks.
DNS tunnels work on an already compromised computer by encoding small amounts of data in a malicious DNS name. The compromised computer can perform a DNS lookup on the malicious domain name and/or use a DNS server controlled by the attacker. When the DNS requests from the compromised computer get to the intended recipient DNS server or device, the attacker can either log that data for later use and/or send a small amount of data back to the compromised computer in the DNS response. The DNS response could be a command for the compromised computer to execute. This exchange can tunnel a small amount of data out of a network and set up indirect communications between two computers on the Internet.
Defending against attacks using DNS tunnels first requires detecting the anomalous DNS traffic. This can be done by monitoring DNS logs or by monitoring the network directly using a tool. The initial DNS server could also be configured to log DNS lookup requests, and those logs could be monitored looking for, for example, a large number of DNS requests from one endpoint or a large number of DNS requests that needed to be forwarded. This same analysis could also be performed by monitoring network traffic.
Organizations can take care of the job in house with DNS security tools or outsource to DNS providers -- such as Neustar Inc., OpenDNS and Percipient Networks -- that can perform analysis on enterprise DNS traffic and can potentially block or blackhole the DNS lookup being sent to the malicious DNS server.
Ask the Expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Learn more about DNS attack prevention
Find out why incident response planning is crucial to prevent DNS attacks
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Researchers have developed an ASLR Cache side-channel attack that enables them to eliminate ASLR protections. Expert Nick Lewis explains how ...continue reading
The SQL Slammer worm has re-emerged to attack a vulnerability in Microsoft SQL Server 2000. Expert Nick Lewis explains what enterprises can do to ...continue reading
The Fruitfly Mac malware has decades-old code, but has been conducting surveillance attacks for over two years without detection. Expert Nick Lewis ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.