Application Security

8/28/2017
01:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Rohde & Schwarz Cybersecurity Launches DNS Tunneling Detection

Company launches enhanced traffic analysis capabilities to detect Domain Name Server (DNS) tunneling.

Leipzig, Germany – Rohde & Schwarz Cybersecurity, a leading IT security company, today announced the launch of enhanced traffic analysis capabilities to detect DNS (Domain Name Server) tunneling. The new functionality provided by the deep packet inspection (DPI) engine R&S PACE 2 can be utilized by IT security solutions to reliably detect malicious activity in network traffic in real time caused by DNS tunneling.

DNS is a core component of the Internet and of paramount importance to the operation of the World Wide Web. It provides the mapping service between a domain name and the corresponding IP, translating human-friendly domain names into IP addresses.

As DNS is a trusted protocol it is often overlooked for security as no one considers using the protocol for data transmission. The use of DNS, especially with port 53, for data theft is called DNS tunneling. In tunneling, cybercriminals use the DNS protocol as an established pathway to direct the exchange of information for malicious purposes. Several tools have been developed to bypass traditional IPS or firewall inspection and network security measures to reach the Internet.

With the enhanced DNS tunneling detection functionality of the DPI engine R&S PACE 2, Rohde & Schwarz Cybersecurity now provides a highly scalable OEM software solution for network protection products. When embedded in a firewall, IT security vendors are able to inspect the entire DNS query for deeper markers of either good or bad behavior. This way, malicious attacks that bypass common security policies via DNS tunneling can be identified and prevented.

According to the DNS Threat Survey 2017 by Efficient IP, 94% claim DNS security is critical for their business. This is not surprising as in the past year, 76% of organizations around the world have been subjected to a DNS attack and a third suffered data theft. In addition, DNS tunneling was one of the leading causes besides malware, DDoS and cache poisoning attacks. If not secured properly, DNS attacks could cost businesses over $2 Billion annually in data exfiltration, loss of business or application downtime, says EfficientIP. The new DNS protocol classification feature not only adds further value to cybersecurity solutions but also improves their reliability and credibility that enterprises can rely on.

Besides the ability to detect DNS tunneling, R&S PACE 2 also provides reliable detection of tunneling in the HTTP protocol.

The DPI software library R&S PACE 2 provides powerful and reliable detection and classification of thousands of applications and protocols by combining deep packet inspection and behavioral traffic analysis – regardless of whether the protocols use advanced obfuscation, port-hopping techniques or encryption. DPI is needed everywhere in the network where intelligent decisions need to be made based on the nature of IP traffic, whether it is wanted or unwanted traffic, good or malicious.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
How Systematic Lying Can Improve Your Security
Lance Cottrell, Chief Scientist, Ntrepid,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.