Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/18/2014
04:00 PM
Dave Piscitello
Dave Piscitello
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

5 Ways To Monitor DNS Traffic For Security Threats

Check out these examples of how to implement real-time or offline traffic monitoring using common commercial or open source security products.

In Monitor DNS Traffic & You Just Might Catch A RAT, I described how inspecting DNS traffic between client devices and your local recursive resolver could reveal the presence of botnets in your networks. Today, I'll share how you can monitor traffic using security systems and name resolvers you may already have deployed.

Firewalls
Let's begin at the most prevalent security system: your firewall. All firewalls should let you define rules to prevent IP spoofing. Include a rule to deny DNS queries from IP addresses outside your allocated numbers space to prevent your name resolver from being exploited as an open reflector in DDoS attacks.

Next, enable inspection of DNS traffic for suspicious byte patterns or anomalous DNS traffic to block name server software exploit attacks. Documentation describing how popular firewalls provide this feature is readily available (e.g., Palo Alto Networks, Cisco Systems, WatchGuard). Sonicwall and Palo Alto can detect and block certain DNS tunneling traffic, as well.

Intrusion detection systems
Whether you use Snort, Suricata, or OSSEC, you can compose rules to report DNS requests from unauthorized clients. You can also compose rules to count or report NXDOMAIN responses, responses containing resource records with short TTLs, DNS queries made using TCP, DNS queries to nonstandard ports, suspiciously large DNS responses, etc. Any value in any field of the DNS query or response message is basically "in play." You're essentially limited only by your imagination and mastery of DNS. Intrusion prevention services in firewalls provide permit/deny rules for many of the most common of these checks.

Traffic analyzers
Use cases for both Wireshark and Bro show that passive traffic analysis can be useful in identifying malware traffic. Capture and filter DNS traffic between your clients and your resolver, and save to a PCAP file. Create scripts to search the PCAP for the specific suspicious activities you are investigating, or use PacketQ (originally DNS2DB) to SQL query the PCAP file directly.

(Remember to block your clients from using any resolver or nonstandard port other than your local resolvers).

Passive DNS replication
This involves using sensors at resolvers to create a database that contains every DNS transaction (query/response) through a given resolver or set of resolvers. Including passive DNS data in your analysis can be instrumental in identifying malware domains, especially in cases where the malware uses algorithmically generated domain names (DGAs). Palo Alto Networks firewalls and security management systems that use Suricata as an IDS engine (like AlienVault USM or OSSIM) are examples of security systems that pair passive DNS with IPS to block known malicious domains.

Logging at your resolver
The logs of your local resolvers are a last and perhaps most obvious data source for investigating DNS traffic. With logging enabled, you can use tools like Splunk plus getwatchlist or OSSEC to collect DNS server logs and explore for known malicious domains.

Despite peppering this column with links to documentation, case studies, and examples, I've barely scratched the surface of the many ways you can monitor DNS traffic. And bear in mind that you can use several of these methods in a complementary manner. I've no doubt overlooked other products, services, or methods, so comment to add to these resources for your colleagues (with technical relevance, please).

Dave Piscitello has been involved with Internet technologies (broadband access, routing, network management, and security) for over 35 years. He left private sector consulting and his company, Core Competence, to provide security and ICT coordination for security and policy ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
dougburks
100%
0%
dougburks,
User Rank: Apprentice
9/19/2014 | 6:09:38 AM
Security Onion
Hi Dave,

Great article!  You mentioned Snort, Suricata, Bro, and OSSEC.  Security Onion is a Linux distro that contains all of these tools and it also includes ELSA for easy slicing and dicing of their logs.

 

 
Robert McDougal
100%
0%
Robert McDougal,
User Rank: Ninja
9/19/2014 | 9:51:44 AM
Re: Security Onion
I have to second the Security Onion suggestion.  Every organization not matter how small, should have an IDS running and security onion is FREE!
JamesR010
100%
0%
JamesR010,
User Rank: Strategist
9/19/2014 | 1:57:50 PM
BIND!
BIND 9.10 will do a lot of what you mention, right out of the box, and for free: ACLs, verbose logging, rate-limiting (for DDoS attack mitigation), and most importantly, Response Policy Zones. I've been using RPZ for a few months now, and it certainly lives up to its alias as "the DNS firewall". I've caught a few infected desktops trying to reach C&C servers that were NOT identified by my firewall, IDSs, Fire sec appliances, and various AV products.
Lucamp
100%
0%
Lucamp,
User Rank: Strategist
9/22/2014 | 7:37:48 AM
Another tool
Hi Dave,

Fantastic artcile by the way. Another tool that you can use for DNS is AIEngine (https://bitbucket.org/camp0/aiengine). We use it combinated with Redis to register Domains and works fine for us.
jpmanibusan
100%
0%
jpmanibusan,
User Rank: Apprentice
4/19/2015 | 12:49:00 PM
Academic Research Papers on pDNS, DGA, NXDOMAIN
Hi Dave- Nice article on a topic that continues to be largely overlooked.

For anyone looking for additional reading along these lines, check out Damballa's DGA archive here https://www.damballa.com/tag/dga/

The collaborative efforts of Damballa and Georgia Tech Applied Mathematics Ph.D researchers have been well documented over the years, and frequently presented at major security research conferences (e.g. USENIX). The academic research papers can be found online by searching for their project names: Notos, Pleiades, and ExecScent, among them.

Cheers, JP
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15150
PUBLISHED: 2019-08-19
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
CVE-2017-18550
PUBLISHED: 2019-08-19
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
CVE-2017-18551
PUBLISHED: 2019-08-19
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
CVE-2017-18552
PUBLISHED: 2019-08-19
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
CVE-2018-20976
PUBLISHED: 2019-08-19
An issue was discovered in fs/xfs/xfs_super.c in the Linux kernel before 4.18. A use after free exists, related to xfs_fs_fill_super failure.