As a Sales Engineer at Infoblox, I\u2019ve had the opportunity to meet thousands of IT and security pros at Fortune 1000 companies.\u00a0 It always amazes me how little attention is given to the DNS protocol as a vulnerable protocol.\u00a0 More importantly, it is also surprising to see the lack of awareness and\/or recognition on this issue, though many an attack (e.g., DNS Messenger) in the recent past have been exploiting DNS servers. \u00a0Even though there has been a huge rise in the use of this protocol as a covert channel and an exploitable vulnerability, many IT departments are still debating whether they should take any security measures to stop DNS attacks, and if so what kind of measures to take.\u00a0 This uncertainty can result in lack of action. Instead they may decide to protect other parts of the stack such as end-points where the impact of the threat is clearer.<\/p>\n
While most corporate IT practitioners attempt to wrap their heads around securing the enterprise from DNS exploits, more and more nefarious entities are writing botnets and \u00a0malware, to take advantage of DNS and using other means – such as DNS tunneling \u2013 to exploit this unsecured entry point into the network.<\/p>\n
Experience at a Casino<\/strong><\/p>\n The best part of my job educating customers on what they are not able to see is happening on their network with DNS. Especially, when they see the data related to exfiltration and DNS tunneling. I was recently working on a Proof of Concept (POC) in Las Vegas at a casino.\u00a0 The customer had almost all the known security measures, such as firewalls (Palo Alto Networks), SIEM (QRadar), IDS\/IDP (Source Fire) and client based incident response (Carbon Black).\u00a0 However, they were particularly interested in DNS Tunneling and Data Exfiltration.\u00a0 The aim of the POC was to showcase the benefit of using Infoblox security measures to protect recursive DNS traffic (lookups out to the Internet).<\/p>\n As a DNS lookup is the\u00a0first<\/u><\/strong>\u00a0thing that happens when a user within the company needs to communicate with the Internet, it is a very good first line of defense for stopping malicious traffic and command and control communications.\u00a0 We identified many malware C2 (command and control) sites immediately that their other Cybersecurity measures were not finding, but the real fireworks started when we turned on our DNS behavioral analytics and started finding DNS tunnels.<\/p>\n NOTE: DNS tunnels are advanced covert tactics that use the DNS protocol as a covert communication channel for moving data in and out of an organization undetected by security measures.\u00a0 This technique essentially hides the nefarious activity by using a prepackaged DNS tunnel software \u2013 with a preconfigured software including a client and server.\u00a0 These can be easily downloaded from internet \u2013 most commonly known are DNSCAT, DNSCAT2, SlowDNS and Iodine.\u00a0 The other method is easier and simpler \u2013 simply hiding the data in the DNS query.\u00a0<\/strong><\/p>\n The security department wanted to know why their other equipment was not catching these \u201cquery based\u201d tunnels.\u00a0 We validated that the DNS tunnels were real and that the workstations being exposed had a browser based add-on that was displaying a marketing banner and looked like it was reporting back demographics and purchasing activity.\u00a0 We blocked the tunnel traffic and they were happy.\u00a0 They ended up putting our DNS security solution in their data centers as well as the 12 sites they could not re-route to data center due to network connectivity.<\/p>\n In the last year, I\u2019ve seen internally launched DNS reflection attacks orchestrated by botnets that took down a network, undetected DNS tunnels being used for gaming devices and one of my colleagues helped an oil company stop Anonymous (Anonymous is a loosely associated international network of activist and hacktivist entities) as they attempted to use DNS to steal (exfiltrate) data out of the customers\u2019 network.<\/p>\n DNS is one of the most useful and necessary protocols on the planet.\u00a0 It\u2019s an infrastructure service and it is essential to most companies, but unprotected it can be used as a powerful weapon to bypass all security measures.\u00a0\u00a0Don\u2019t let your DNS traffic go unexamined \u2013 firewalls and endpoint security are very important –\u00a0 but they will not protect your data from unprotected DNS traffic!<\/p>\n","protected":false},"excerpt":{"rendered":" As a Sales Engineer at Infoblox, I\u2019ve had the opportunity to meet thousands of IT and security pros at Fortune 1000 companies.\u00a0 It always amazes me how little attention is given to the DNS protocol as a vulnerable protocol.\u00a0 More importantly, it is also surprising to see the lack of awareness and\/or recognition on this […]<\/p>\n","protected":false},"author":149,"featured_media":1797,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[30,16,15],"class_list":{"0":"post-1991","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-company","8":"tag-dns","9":"tag-infoblox","10":"tag-security","11":"entry"},"acf":[],"yoast_head":"\n