Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

Got Malware? Three Signs Revealed In DNS Traffic

Monitoring your network's requests for domain lookups can reveal network problems and potential malware infections

Companies focus much of their energy on hardening computer systems against threats and stopping attempts to breach their systems' security -- and rightfully so. However, companies should always assume that the attackers have already successfully compromised systems and look for the telltale signs of such a breach.

Because malware is increasingly using a variety of domain techniques to foil takedown efforts and make their command-and-control servers harder to locate, DNS traffic becomes a good indicator of compromise, say security experts. Monitoring the network for strange DNS behavior can help pinpoint infections, says Patrick Foxhoven, chief technology officer of emerging technologies for cloud security firm Zscaler.

"DNS is the way that most modern malware is connecting back to their operators' command-and-control infrastructure," he says. "DNS allows them to create or register a domain or a random set of domains and continue changing which IP those domains resolve to. Having visibility at the DNS level is huge."

Domain-name service traffic is so ubiquitous that many companies do not think about analyzing domain lookups and responses to find network problems and malware infection. Moreover, collecting the data and analyzing it presents challenges and can slow down the infrastructure, says Stephen Newman, vice president of products for network-security firm Damballa.

"There are some challenges there, some rather difficult challenges," Newman says. "Unfortunately, these DNS systems that are out there really don't support logging very well. It is very difficult for enterprises to extract out and store the DNS activity that has occurred."

[Trade-offs are a fact of life for network defenders, but attackers have to abide them as well. Understanding attackers' problems can help companies better use them to their advantage. See The Attacker's Trade-Off: Stealth Versus Resilience.]

Yet for companies that can collect and analyze the data, DNS can become an important component of their security-monitoring systems. From fast-flux domains to domain-generation algorithms, here are a few signs of malware as seen through DNS traffic.

1. Young domains
When employees' systems look up domains that are less than a week -- or a day -- old, companies should start investigating, Zscaler's Foxhoven says. Young domains are a solid sign that a machine has been infected with malware.

Companies can either monitor and investigate the traffic or just block the requests, Foxhoven says.

"Maybe the solution for your company is that you do not want to allow traffic to go to a site that is less than 24 hours old," he says. "There are a lot of domain names that are new, and they are hosting malicious content."

2. Esoteric domains
Not just age, but the uniqueness of a domain can be a tip that some unsavory activity is going on, Damballa's Newman says. If only a handful of employees appear to be going to a relatively unknown site, that could indicate that their machines have been compromised, he says.

"If you just have one or two domains that only a few devices are querying, that is a good thing to start looking at," he says.

As with young domains, esoteric domains can escape IP blacklists that might otherwise signal the company that the domain is hosting a malicious Web site.

3. Lookup failures
Finally, if a computer has a large number of failed domain lookups, that could also be a sign that something is wrong, Newman says. Domain-generation algorithms, which attempt to foil defenders by generating thousands of possible domain names every day in a digital shell game, have a recognizable traffic pattern, he says.

"If we see a device that tries 1,000 different domains and only one or two are valid, then we will focus on that device," Newman says.

By only registering one or two of the domains generated by the algorithm, the attacker uses the technique to keep defenders guessing.

While DNS can be an effective technique, both Damballa and Zscaler stress that it is only one part of the picture. Both companies treat DNS as only one of the indicators of malicious activity, not as a single sure sign of infection.

"If you have access to DNS, you can add a lot of security value," Foxhoven says. "Yet it's still only one part of the equation."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
TrevorHawthorn
50%
50%
TrevorHawthorn,
User Rank: Apprentice
5/6/2013 | 8:12:33 PM
re: Got Malware? Three Signs Revealed In DNS Traffic
I wrote a blog post on how to use Splunk to log and analyze suspicious DNS requests that may be of interest here: http://stratumsecurity.com/201...
dangleebits2
50%
50%
dangleebits2,
User Rank: Apprentice
5/4/2013 | 5:35:43 PM
re: Got Malware? Three Signs Revealed In DNS Traffic
There are at least 22 Indicators for DNS http://bigsnarf.wordpress.com/...
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13611
PUBLISHED: 2019-07-16
An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
CVE-2019-0234
PUBLISHED: 2019-07-15
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of ...
CVE-2018-7838
PUBLISHED: 2019-07-15
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP C...
CVE-2019-6822
PUBLISHED: 2019-07-15
A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.
CVE-2019-6823
PUBLISHED: 2019-07-15
A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.