Decoding the DNS: A New Arena in Cyber Defence

How_DNS_Works.jpg

How Domain Name System (DNS) Works

Any company with a large DNS Domain Name System infrastructure will find it difficult to understand what is happening in real time. This is down to the sheer volume of data involved – you could be looking for patterns in millions if not billions of requests to and around your network.However, new tools are emerging which capitalise on advanced big data techniques to analyse DNS data in depth, opening up the possibilities for using DNS data as an intelligence gathering mechanism in the war against cyber-crime.

Before now, the insights that can be found amongst the four billion DNS queries that the UK zone receives on a daily basis have largely been hidden because tools capable of analysing traffic across periods of more than a few minutes didn't exist. But with new DNS analytics and visualisation tools that have the capacity to store and analyse DNS queries data in-depth, we've begun to uncover techniques for identifying patterns of use that indicate malicious activity or cyber security vulnerabilities. Here are two:

Identifying botnets and spam

One example of cyber intelligence that can be gained from DNS analysis relates to botnets. Botnets continue to contribute to DDoS attacks and spam runs. Recent research from Kaspersky found that over 23,000 botnet-assisted DDoS attacks were reported in Q1 of this year alone. Spam email also continues to cause problems – despite recently dropping to a 12 year low spam still represents almost half of all emails sent.
DNS data can reveal previously hidden tell tale signs that computers on your network have become part of a botnet. A typical spam run centres on mass mailing to a list which almost inevitably will contain many invalid or expired domains. DNS analysis can reveal abnormally large numbers of requests for domains that do not exist, suggesting that machines on the network have been compromised.
By recognising specific infections early, it's possible to quickly clean up or at least isolate the infected machines and reduce the amount of spam crossing your network. The bigger your infrastructure, the more helpful such techniques are.

Limiting the spread of malware

The fight against malware is another area which can be assisted by DNS analysis. When it comes to Malware Index Case detection, DNS analysis has enabled the identification of a particularly aggressive piece of malware by tracking infected machines which were using something called a Domain Generation Algorithm (DGA), an algorithm that generates a number of random domains for botnets to communicate with.
DGA works by using an algorithm that generates a number of domains that changes periodically, and is often spread over many jurisdictions which means it is hard to predict. This allows the cyber-criminal to communicate with a large army of machines but reduces the risk of a white-hat adversary taking back control, as instead of having a single point of vulnerability, the cyber-criminal has many domains to hide behind.
DGAs are used by many pieces of malware, and tend to have two characteristics: They look like random strings and are in use for only a fixed period of time, commonly 24 hours. This means that a machine on your network that's trying to resolve a set of domains which don't look like humanly readable words i.e. iaurghriugharui.co.uk, may well be an infected machine.
If the set of domains changes on a daily basis, then this is even stronger evidence. By analysing DNS data, security professionals can find, predict and sinkhole the traffic of most DGAs by looking into a company's recursive DNS traffic.
 With cyber-criminals constantly finding new and intelligent ways in which to infiltrate a company's network, the ability to analyse DNS data opens up a whole new avenue of protection for organisations.
Decoding the DNS gives businesses another tool in their arsenal, one which was previously significantly more limited than it is now. If your organisation has a large DNS infrastructure but you haven't previously been able to extract meaningful intelligence from DNS data, now may be the time to consider reassessing your options.
SC Magazine: http://bit.ly/1ia9wO6

 

 

 

« A New Design for Cryptography’s Black Box
DEMOS: The Road to Representivity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Digital Detective

Digital Detective

Digital Detective offer a range of products and services for digital forensic analysis and advanced data recovery.

Security Brigade

Security Brigade

Security Brigade is an information security firm specializing in Penetration Testing, Vulnerability Assessment, Web-application Security and Source Code Security Audit.

ID Agent

ID Agent

ID Agent provides a comprehensive set of threat intelligence and identity monitoring solutions.

NPCore

NPCore

NPCore is specialized in defense solution against unknown APT and Ransomware and provides two-level defense on network and endpoint based on behavior.

Learning Tree International

Learning Tree International

Learning Tree's comprehensive cyber security training curriculum includes specialised IT security training and general cyber security courses for all levels of your organisation including the C-suite.

Taqnia Cyber

Taqnia Cyber

Taqnia Cyber specializes in the fields of cyber security, intelligence, operations, and training. It offers its services and consultations to both public and private sectors.

AlAnsari Technical Solutions (ATS)

AlAnsari Technical Solutions (ATS)

ATS is a Kuwait based company specialised in delivering hardware/software, Virtualisation, IP Telephony / Unified Communication, Networking and professional IT services and solutions.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Threat Defense (CT Defense)

Cyber Threat Defense (CT Defense)

CT Defense specialize in penetration testing and security assessments.

Microchip Technology

Microchip Technology

Microchip Technology Inc. is a leading provider of smart, connected and secure embedded control solutions.

Cyber Security Advisor

Cyber Security Advisor

Notice how sophisticated the cybersecurity market is. Think how would you pick the security provider, assess your company, and be sure of your security decisions? Cyber Security Advisor is the answer!

Qascom

Qascom

Qascom is an engineering company offering security solutions in satellite navigation and space cybersecurity. We are one of the European key players in GNSS authentication and security.

Elisity

Elisity

Elisity Cognitive Trust is a new security paradigm that combines Zero Trust Network Access and an AI-enabled Software Defined Perimeter.

ZINAD IT

ZINAD IT

ZINAD is an information security company offering state-of-the-art cybersecurity awareness products, solutions and services.

Cyber Suraksa

Cyber Suraksa

We make security simple and hassle-free by offering a sustained and secure IT environment with next-gen cybersecurity solutions through a scalable security-as-a-service model.

Thunder Shield Security

Thunder Shield Security

Thunder Shield is a professional cyber security service provider of penetration test, source code review and security assessment services.