Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
5 Ways To Monitor DNS Traffic For Security Threats
Newest First  |  Oldest First  |  Threaded View
jpmanibusan
100%
0%
jpmanibusan,
User Rank: Apprentice
4/19/2015 | 12:49:00 PM
Academic Research Papers on pDNS, DGA, NXDOMAIN
Hi Dave- Nice article on a topic that continues to be largely overlooked.

For anyone looking for additional reading along these lines, check out Damballa's DGA archive here https://www.damballa.com/tag/dga/

The collaborative efforts of Damballa and Georgia Tech Applied Mathematics Ph.D researchers have been well documented over the years, and frequently presented at major security research conferences (e.g. USENIX). The academic research papers can be found online by searching for their project names: Notos, Pleiades, and ExecScent, among them.

Cheers, JP
Lucamp
100%
0%
Lucamp,
User Rank: Strategist
9/22/2014 | 7:37:48 AM
Another tool
Hi Dave,

Fantastic artcile by the way. Another tool that you can use for DNS is AIEngine (https://bitbucket.org/camp0/aiengine). We use it combinated with Redis to register Domains and works fine for us.
JamesR010
100%
0%
JamesR010,
User Rank: Strategist
9/19/2014 | 1:57:50 PM
BIND!
BIND 9.10 will do a lot of what you mention, right out of the box, and for free: ACLs, verbose logging, rate-limiting (for DDoS attack mitigation), and most importantly, Response Policy Zones. I've been using RPZ for a few months now, and it certainly lives up to its alias as "the DNS firewall". I've caught a few infected desktops trying to reach C&C servers that were NOT identified by my firewall, IDSs, Fire sec appliances, and various AV products.
Robert McDougal
100%
0%
Robert McDougal,
User Rank: Ninja
9/19/2014 | 9:51:44 AM
Re: Security Onion
I have to second the Security Onion suggestion.  Every organization not matter how small, should have an IDS running and security onion is FREE!
dougburks
100%
0%
dougburks,
User Rank: Apprentice
9/19/2014 | 6:09:38 AM
Security Onion
Hi Dave,

Great article!  You mentioned Snort, Suricata, Bro, and OSSEC.  Security Onion is a Linux distro that contains all of these tools and it also includes ELSA for easy slicing and dicing of their logs.

 

 


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33347
PUBLISHED: 2021-06-18
An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the background by means of weak password, the storage XSS vulnerability can occur.
CVE-2021-33576
PUBLISHED: 2021-06-18
An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk.
CVE-2021-33577
PUBLISHED: 2021-06-18
An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves (via encryption and signing of the message) can be bypassed by changing the Content-Type of the message to text/plain.
CVE-2021-32536
PUBLISHED: 2021-06-18
The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks.
CVE-2021-21669
PUBLISHED: 2021-06-18
Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.