Beware of DNS Tunnelling: A Sophisticated Cyberattack

Before discussing DNS tunnelling, it is worth recalling that the Domain Name System (DNS) is the protocol that translates Uniform Resource Locators (URLs) (machine-readable IP addresses, such as 199.167.52.137) into names that people can understand.

DNS is a fundamental internet protocol and is often described as the 'phone book of the internet' because it maps domain names to IP addresses.

Because DNS is so widespread and the security controls associated with it are limited, it is often possible to communicate and exchange data beyond the protocol's original purposes. Cybercriminals have therefore identified this weakness as an opportunity for malicious activity.

Furthermore, because DNS was not designed as a way of transporting data, many organisations do not monitor DNS traffic for malicious activity. As a result, several types of attack use this protocol against corporate networks. DNS tunnelling is one such attack.

How DNS Tunnelling Works

DNS tunnelling attacks exploit the DNS protocol to transfer malware and other data using a client-server model.

1. The attacker registers a domain, such as badsite.com. DNS then communicates with the registered server, on which tunnelling malware has been installed.
2. The attacker infects a computer, often located behind a company's firewall. Because DNS requests are generally allowed through the firewall in both directions, the infected computer can send a DNS query. A DNS server forwards requests for IP addresses to root servers and top-level domain servers.
3. DNS routes the query to the attacker's command-and-control server, where the tunnelling software is installed. A connection is now established between the victim and the attacker through the DNS resolver. This tunnel can be used to exfiltrate data or for other malicious purposes. Because there is no direct connection between the attacker and the victim, tracing the attacker's computer is more difficult.

DNS tunnelling has existed for nearly 20 years. Both Morto and Feederbot malware have been used for DNS tunnelling. More recent DNS tunnelling attacks include those attributed to the DarkHydrus threat group, which targeted government organisations in the Middle East in 2018, and OilRig, which has been operating since 2016 and is still reported to be active.

Preventing DNS Tunnelling

DNS is a powerful, widely used tool that enables applications and systems to find resources and services with which to interact.

DNS provides the communications foundation that allows more advanced and powerful protocols to operate, but it can be overlooked from a security perspective, especially given how much malware is distributed through email protocols or downloaded from the web using HTTP.
For these reasons, DNS is an ideal choice for adversaries seeking an always-available, overlooked and underestimated protocol to exploit for communications to and from compromised hosts.
Organisations can defend against DNS tunnelling in several ways, using both Leonardo Networks' network security platform and open-source technologies. Defences can take various forms, including, but not limited to, the following:

• Blocking domain names (or IP addresses or geographical regions) based on known reputation or perceived risk;
• Rules to identify unusual DNS queries;
• Rules governing the length, type or size of incoming and outgoing DNS queries;
• Hardening client operating systems and understanding their name-resolution capabilities and specific lookup order;
• Analysing user and/or system behaviour to automatically detect anomalies, such as access to new domains, particularly when the access method and frequency are unusual;

Best Practices for DNS Security

• Train and educate security personnel
  Implement a security education and awareness programme to train staff to identify malicious threats. Encourage them to take precautions when following links to avoid installing malware. Phishing training can help them recognise, avoid and report email-based attacks.
• Implement a threat intelligence programme
  Understand the threat landscape and establish a threat intelligence programme to stay aware of the different types of threats and techniques used by attackers today. With this information, you can ensure that you have the right technology to keep your network secure.
• Learn what DNS data can tell you
  Do more than simply look at DNS traffic. Collecting DNS data logs has little value if you do not understand what you are seeing. Understanding the data can help you successfully prevent previously unseen DNS-level threats within your organisation.
• Do not delay DNS resolver management
  If a DNS server is compromised, it can return false responses that direct your traffic to other compromised systems or enable a man-in-the-middle attack.
• Plan for the risks of remote working
  Develop a strategy for your remote workforce, as remote working can put the company's sensitive data at risk. Warn staff against using unsecured, free or public Wi-Fi networks, where adversaries can easily position themselves between employees and the access point. Introduce multi-factor authentication and prepare for the risk of lost or stolen devices.
• Take a holistic approach to network security
  Adopt a holistic approach to network security and ensure that you have the right capabilities to address different threat vectors across your network, with easy integration throughout your security stack. When evaluating vendors' solutions, it is important to conduct direct comparisons through proof-of-concept testing. Every environment is different, and independent, neutral testing standards for DNS-level security have not yet been established.
• Automate responses, not just alerts
  To protect your organisation successfully, you need to respond automatically rather than merely receive alerts. The speed at which attacks unfold can make alerts and notifications ineffective. By the time a threat is identified, it may already be too late. Your security team must be able to identify threats automatically and quarantine potentially infected systems before further damage occurs. To ensure that your organisation follows best practices and optimises Leonardo Networks' DNS security service, you can carry out a best-practice assessment.

Source paloaltonetworks.com