Got Malware? Three Signs Revealed In DNS Traffic

Companies focus much of their energy on hardening computer systems against threats and stopping attempts to breach their systems' security -- and rightfully so. However, companies should always assume that the attackers have already successfully compromised systems and look for the telltale signs of such a breach.

Because malware is increasingly using a variety of domain techniques to foil takedown efforts and make their command-and-control servers harder to locate, DNS traffic becomes a good indicator of compromise, say security experts. Monitoring the network for strange DNS behavior can help pinpoint infections, says Patrick Foxhoven, chief technology officer of emerging technologies for cloud security firm Zscaler.

"DNS is the way that most modern malware is connecting back to their operators' command-and-control infrastructure," he says. "DNS allows them to create or register a domain or a random set of domains and continue changing which IP those domains resolve to. Having visibility at the DNS level is huge."

Domain-name service traffic is so ubiquitous that many companies do not think about analyzing domain lookups and responses to find network problems and malware infection. Moreover, collecting the data and analyzing it presents challenges and can slow down the infrastructure, says Stephen Newman, vice president of products for network-security firm Damballa.

"There are some challenges there, some rather difficult challenges," Newman says. "Unfortunately, these DNS systems that are out there really don't support logging very well. It is very difficult for enterprises to extract out and store the DNS activity that has occurred."

[Trade-offs are a fact of life for network defenders, but attackers have to abide them as well. Understanding attackers' problems can help companies better use them to their advantage. See The Attacker's Trade-Off: Stealth Versus Resilience.]

Yet for companies that can collect and analyze the data, DNS can become an important component of their security-monitoring systems. From fast-flux domains to domain-generation algorithms, here are a few signs of malware as seen through DNS traffic.

1. Young domains
When employees' systems look up domains that are less than a week -- or a day -- old, companies should start investigating, Zscaler's Foxhoven says. Young domains are a solid sign that a machine has been infected with malware.

Companies can either monitor and investigate the traffic or just block the requests, Foxhoven says.

"Maybe the solution for your company is that you do not want to allow traffic to go to a site that is less than 24 hours old," he says. "There are a lot of domain names that are new, and they are hosting malicious content."

2. Esoteric domains
Not just age, but the uniqueness of a domain can be a tip that some unsavory activity is going on, Damballa's Newman says. If only a handful of employees appear to be going to a relatively unknown site, that could indicate that their machines have been compromised, he says.

"If you just have one or two domains that only a few devices are querying, that is a good thing to start looking at," he says.

As with young domains, esoteric domains can escape IP blacklists that might otherwise signal the company that the domain is hosting a malicious Web site.

3. Lookup failures
Finally, if a computer has a large number of failed domain lookups, that could also be a sign that something is wrong, Newman says. Domain-generation algorithms, which attempt to foil defenders by generating thousands of possible domain names every day in a digital shell game, have a recognizable traffic pattern, he says.

"If we see a device that tries 1,000 different domains and only one or two are valid, then we will focus on that device," Newman says.

By only registering one or two of the domains generated by the algorithm, the attacker uses the technique to keep defenders guessing.

While DNS can be an effective technique, both Damballa and Zscaler stress that it is only one part of the picture. Both companies treat DNS as only one of the indicators of malicious activity, not as a single sure sign of infection.

"If you have access to DNS, you can add a lot of security value," Foxhoven says. "Yet it's still only one part of the equation."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.