Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics //

Security Monitoring

Got Malware? Three Signs Revealed In DNS Traffic

Monitoring your network's requests for domain lookups can reveal network problems and potential malware infections

Companies focus much of their energy on hardening computer systems against threats and stopping attempts to breach their systems' security -- and rightfully so. However, companies should always assume that the attackers have already successfully compromised systems and look for the telltale signs of such a breach.

Because malware is increasingly using a variety of domain techniques to foil takedown efforts and make their command-and-control servers harder to locate, DNS traffic becomes a good indicator of compromise, say security experts. Monitoring the network for strange DNS behavior can help pinpoint infections, says Patrick Foxhoven, chief technology officer of emerging technologies for cloud security firm Zscaler.

"DNS is the way that most modern malware is connecting back to their operators' command-and-control infrastructure," he says. "DNS allows them to create or register a domain or a random set of domains and continue changing which IP those domains resolve to. Having visibility at the DNS level is huge."

Domain-name service traffic is so ubiquitous that many companies do not think about analyzing domain lookups and responses to find network problems and malware infection. Moreover, collecting the data and analyzing it presents challenges and can slow down the infrastructure, says Stephen Newman, vice president of products for network-security firm Damballa.

"There are some challenges there, some rather difficult challenges," Newman says. "Unfortunately, these DNS systems that are out there really don't support logging very well. It is very difficult for enterprises to extract out and store the DNS activity that has occurred."

[Trade-offs are a fact of life for network defenders, but attackers have to abide them as well. Understanding attackers' problems can help companies better use them to their advantage. See The Attacker's Trade-Off: Stealth Versus Resilience.]

Yet for companies that can collect and analyze the data, DNS can become an important component of their security-monitoring systems. From fast-flux domains to domain-generation algorithms, here are a few signs of malware as seen through DNS traffic.

1. Young domains
When employees' systems look up domains that are less than a week -- or a day -- old, companies should start investigating, Zscaler's Foxhoven says. Young domains are a solid sign that a machine has been infected with malware.

Companies can either monitor and investigate the traffic or just block the requests, Foxhoven says.

"Maybe the solution for your company is that you do not want to allow traffic to go to a site that is less than 24 hours old," he says. "There are a lot of domain names that are new, and they are hosting malicious content."

2. Esoteric domains
Not just age, but the uniqueness of a domain can be a tip that some unsavory activity is going on, Damballa's Newman says. If only a handful of employees appear to be going to a relatively unknown site, that could indicate that their machines have been compromised, he says.

"If you just have one or two domains that only a few devices are querying, that is a good thing to start looking at," he says.

As with young domains, esoteric domains can escape IP blacklists that might otherwise signal the company that the domain is hosting a malicious Web site.

3. Lookup failures
Finally, if a computer has a large number of failed domain lookups, that could also be a sign that something is wrong, Newman says. Domain-generation algorithms, which attempt to foil defenders by generating thousands of possible domain names every day in a digital shell game, have a recognizable traffic pattern, he says.

"If we see a device that tries 1,000 different domains and only one or two are valid, then we will focus on that device," Newman says.

By only registering one or two of the domains generated by the algorithm, the attacker uses the technique to keep defenders guessing.

While DNS can be an effective technique, both Damballa and Zscaler stress that it is only one part of the picture. Both companies treat DNS as only one of the indicators of malicious activity, not as a single sure sign of infection.

"If you have access to DNS, you can add a lot of security value," Foxhoven says. "Yet it's still only one part of the equation."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
TrevorHawthorn
50%
50%
TrevorHawthorn,
User Rank: Apprentice
5/6/2013 | 8:12:33 PM
re: Got Malware? Three Signs Revealed In DNS Traffic
I wrote a blog post on how to use Splunk to log and analyze suspicious DNS requests that may be of interest here: http://stratumsecurity.com/201...
dangleebits2
50%
50%
dangleebits2,
User Rank: Apprentice
5/4/2013 | 5:35:43 PM
re: Got Malware? Three Signs Revealed In DNS Traffic
There are at least 22 Indicators for DNS http://bigsnarf.wordpress.com/...
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...