{"id":3616,"date":"2014-02-13T10:38:16","date_gmt":"2014-02-13T10:38:16","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=3616"},"modified":"2022-10-19T16:33:26","modified_gmt":"2022-10-19T23:33:26","slug":"dns-tunneling-infoblox-advanced-dns-protection-and-dns-firewall-can-help-stop-data-exfiltration","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/community\/dns-tunneling-infoblox-advanced-dns-protection-and-dns-firewall-can-help-stop-data-exfiltration\/","title":{"rendered":"DNS Tunneling- Infoblox Advanced DNS Protection and DNS Firewall Can Help Stop Data Exfiltration"},"content":{"rendered":"
\n
\n
\n
\n
\n

A great write up by one of Infoblox’s technical experts, Frank Hecker that I wanted to share as a blog. Very valuable insights on DNS deployment to stop data exfiltration via DNS.<\/p>\n

First, if you\u2019re not reading Brian Krebs\u2019 blog \u201cKrebsonSecurity<\/a><\/strong>,\u201d you should be; it\u2019s one of the best, if not the best, sources of news about real-life criminal hackers and their attacks. His recent \u201cinsider story” about an investigation into a security breach at a retailer (similar to the recently-publicized attack on the point-of-sale systems at Target), titled \u201cThese Guys Battle BlackPOS at a Retailer<\/a>,\u201d includes this interesting paragraph.<\/p>\n

We were never able to figure out how they egressed the data. The only protocols that were allowed outbound were DNS. So if they wrapped the stolen data up in outbound DNS packets, maybe. We never solved that problem, we were still looking when the engagement ended. We could see it was doing a lot of the work, but we couldn\u2019t see it was actually leaving the organization.<\/p>\n

In other words, they didn\u2019t have much visibility into what was going on with DNS, and didn\u2019t have any real way to detect and mitigate the use of DNS to tunnel malware-related traffic back to the attackers.<\/p>\n

This is one of the things that Advanced DNS Protection is intended to address: If Infoblox Advanced Appliances with ADP (PT-1400, PT-2200, or PT-4000) are deployed inside the network to serve as recursive resolvers for internal DNS clients, then they can analyze DNS queries originating from PCs and other systems and identify signs that such queries are being used to exfiltrate data from the network. As noted in the Advanced DNS Protection description:<\/p>\n

For tunneling, Advanced DNS Protection drops the DNS tunneled queries with the ability to throttle so that legitimate usage of that DNS tunneling technique for AV updates, as an example, goes through.<\/p>\n

There can be a slow trickle of data exfiltration via DNS with ADP.\u00a0So while ADP cannot completely eliminate use of DNS for data exfiltration, it can at least make it more difficult, and allow potential cases of DNS tunneling to be identified and investigated. This includes identifying<\/p>\n