Malware creators are using DNS requests for data exfiltration. How do these attacks work, and what are the best...
ways to defend against them?
Advanced attackers have been using DNS tunnels, ICMP tunnels, among others, for many years. Due to their successes, many other attackers have also adopted the technique, leading to its rise in popularity. DNS has also typically been allowed to connect outbound to the Internet without filtering, allowing attackers to use it to tunnel data out of compromised networks.
DNS tunnels work on an already compromised computer by encoding small amounts of data in a malicious DNS name. The compromised computer can perform a DNS lookup on the malicious domain name and/or use a DNS server controlled by the attacker. When the DNS requests from the compromised computer get to the intended recipient DNS server or device, the attacker can either log that data for later use and/or send a small amount of data back to the compromised computer in the DNS response. The DNS response could be a command for the compromised computer to execute. This exchange can tunnel a small amount of data out of a network and set up indirect communications between two computers on the Internet.
Defending against attacks using DNS tunnels first requires detecting the anomalous DNS traffic. This can be done by monitoring DNS logs or by monitoring the network directly using a tool. The initial DNS server could also be configured to log DNS lookup requests, and those logs could be monitored looking for, for example, a large number of DNS requests from one endpoint or a large number of DNS requests that needed to be forwarded. This same analysis could also be performed by monitoring network traffic.
Organizations can take care of the job in house with DNS security tools or outsource to DNS providers -- such as Neustar Inc., OpenDNS and Percipient Networks -- that can perform analysis on enterprise DNS traffic and can potentially block or blackhole the DNS lookup being sent to the malicious DNS server.
Ask the Expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Learn more about DNS attack prevention
Find out why incident response planning is crucial to prevent DNS attacks
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
The OurMine hacking group recently used DNS poisoning to attack WikiLeaks and take over its web address. Learn how this attack was performed from ...continue reading
Typosquatting was used by threat actors to spread malware in the NPM registry. Learn from expert Nick Lewis how this method was used and what it ...continue reading
Threat actors are using phishing email campaigns to fool users with tech support scams and fake Blue Screens of Death. Learn how these campaigns work...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.