Decoding the DNS: A New Arena in Cyber Defence

How_DNS_Works.jpg

How Domain Name System (DNS) Works

Any company with a large DNS Domain Name System infrastructure will find it difficult to understand what is happening in real time. This is down to the sheer volume of data involved – you could be looking for patterns in millions if not billions of requests to and around your network.However, new tools are emerging which capitalise on advanced big data techniques to analyse DNS data in depth, opening up the possibilities for using DNS data as an intelligence gathering mechanism in the war against cyber-crime.

Before now, the insights that can be found amongst the four billion DNS queries that the UK zone receives on a daily basis have largely been hidden because tools capable of analysing traffic across periods of more than a few minutes didn't exist. But with new DNS analytics and visualisation tools that have the capacity to store and analyse DNS queries data in-depth, we've begun to uncover techniques for identifying patterns of use that indicate malicious activity or cyber security vulnerabilities. Here are two:

Identifying botnets and spam

One example of cyber intelligence that can be gained from DNS analysis relates to botnets. Botnets continue to contribute to DDoS attacks and spam runs. Recent research from Kaspersky found that over 23,000 botnet-assisted DDoS attacks were reported in Q1 of this year alone. Spam email also continues to cause problems – despite recently dropping to a 12 year low spam still represents almost half of all emails sent.
DNS data can reveal previously hidden tell tale signs that computers on your network have become part of a botnet. A typical spam run centres on mass mailing to a list which almost inevitably will contain many invalid or expired domains. DNS analysis can reveal abnormally large numbers of requests for domains that do not exist, suggesting that machines on the network have been compromised.
By recognising specific infections early, it's possible to quickly clean up or at least isolate the infected machines and reduce the amount of spam crossing your network. The bigger your infrastructure, the more helpful such techniques are.

Limiting the spread of malware

The fight against malware is another area which can be assisted by DNS analysis. When it comes to Malware Index Case detection, DNS analysis has enabled the identification of a particularly aggressive piece of malware by tracking infected machines which were using something called a Domain Generation Algorithm (DGA), an algorithm that generates a number of random domains for botnets to communicate with.
DGA works by using an algorithm that generates a number of domains that changes periodically, and is often spread over many jurisdictions which means it is hard to predict. This allows the cyber-criminal to communicate with a large army of machines but reduces the risk of a white-hat adversary taking back control, as instead of having a single point of vulnerability, the cyber-criminal has many domains to hide behind.
DGAs are used by many pieces of malware, and tend to have two characteristics: They look like random strings and are in use for only a fixed period of time, commonly 24 hours. This means that a machine on your network that's trying to resolve a set of domains which don't look like humanly readable words i.e. iaurghriugharui.co.uk, may well be an infected machine.
If the set of domains changes on a daily basis, then this is even stronger evidence. By analysing DNS data, security professionals can find, predict and sinkhole the traffic of most DGAs by looking into a company's recursive DNS traffic.
 With cyber-criminals constantly finding new and intelligent ways in which to infiltrate a company's network, the ability to analyse DNS data opens up a whole new avenue of protection for organisations.
Decoding the DNS gives businesses another tool in their arsenal, one which was previously significantly more limited than it is now. If your organisation has a large DNS infrastructure but you haven't previously been able to extract meaningful intelligence from DNS data, now may be the time to consider reassessing your options.
SC Magazine: http://bit.ly/1ia9wO6

 

 

 

« A New Design for Cryptography’s Black Box
DEMOS: The Road to Representivity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Clearpath Solutions Group

Clearpath Solutions Group

Clearpath Solutions Group expertise covers virtualization and data storage technologies, networking, security and cloud computing.

Octopus Cybercrime Community

Octopus Cybercrime Community

The Octopus Community is a platform for information sharing and cooperation on cybercrime and electronic evidence.

Stott & May

Stott & May

Stott & May is a specialist cyber security recruitment agency.

Federation of Finnish Technology Industries

Federation of Finnish Technology Industries

The Federation of Finnish Technology Industries is the lobbying organisation for technology industry companies in Finland.

Fair Isaac Corporation (FICO)

Fair Isaac Corporation (FICO)

FICO provides analytics software and tools used across multiple industries to manage risk, fight fraud, optimize operations and meet strict government regulations.

Digital Innovation Hub Slovenia (DIH)

Digital Innovation Hub Slovenia (DIH)

DIH Slovenia is a central hub providing services to grow digital competencies in areas including robotics, IoT, cyberphysical systems and cybersecurity.

ShiftLeft

ShiftLeft

ShiftLeft is a continuous application security platform, purpose-built for the modern software development life cycle.

VS Security Products

VS Security Products

VS Security Products design, manufacture and sell the most extensive range of degaussers and data destroyers on the market, suitable for all types of magnetic media.

SOSA

SOSA

SOSA facilitates new growth opportunities by connecting the dots between industry verticals and innovation ecosystems around the world.

DigiSec360

DigiSec360

DigiSec360 is a technology firm focused on the human element of cybersecurity.

K2 Cyber Security

K2 Cyber Security

K2 Cyber Security delivers the Next Generation Application Workload Protection Platform to secure web applications and container workloads against sophisticated attacks.

Emagined Security

Emagined Security

Emagined Security is a leading provider of professional services for Information Security and Compliance solutions.

Onevinn

Onevinn

Onevinn's goal is to create a transparent, cost-effective security that is noticed as little as possible by the users. We simply call it "intelligent security."

Codean

Codean

The Codean Review Environment automates mundane software analysis tasks, so security experts can focus on finding vulnerabilities.

Apex Systems

Apex Systems

Apex Systems is a world-class technology services business that incorporates industry insights and experience to deliver solutions that fulfill our clients’ digital visions.

Fernao Group

Fernao Group

Fernao offer you all solutions from a single source - from cyber security, business resilience and digital infrastructure to cloud technologies and pentesting.