The dark side of the DNS or the war of the port 53
What is DNS and why is it used?
DNS stands for Domain Name System. It’s essentially like a directory but for the internet. When you type a website address into your browser, like “www.example.com”, your computer needs to find out the IP address associated with that domain name to connect to the correct server.
DNS servers are like the internet’s address book, mapping domain names to their respective IP addresses. They translate human-readable domain names into IP addresses that computers use to identify each other on the network.
DNS is used to make internet communication easier for humans by allowing us to use memorable domain names instead of having to remember long strings of numbers for every website we want to visit. Additionally, it plays a crucial role in the functioning of the internet by ensuring that internet traffic is directed efficiently to the appropriate servers.
Is DNS vulnerable?
The DNS protocol is considered vulnerable to various types of attacks and exploits. While DNS is fundamental to how the internet operates, its design and implementation have inherent vulnerabilities that can be exploited by malicious actors.
The consequences of a DNS attack can be serious and far-reaching, affecting not only the targeted organization but also its customers, partners, and stakeholders. It underscores the importance of implementing robust security measures to protect against DNS attacks and mitigate their impact if they occur.
Some of potential impacts of a DNS attack include: disruption of services, data theft and breaches, damage to reputation, financial losses, and regulatory compliance violations.
What are the most sophisticated DNS attacks?
We are all familiar with classic DNS-based attacks such as DNS Cache Poisoning, DNS Reflexion attack, DNS Amplification attack, DNS Pseudo Random SubDomain (PRSD) attack, DNS NX Domain attack, etc. ….
However, less is known about the techniques and algorithms behind these attacks. And since most modern malware uses DNS in at least one of the 7 stages of the Cyber Kill Chain, here’s a little insight into these techniques:
– DNS Sinkhole: This is a technique for protecting against malicious domains by redirecting traffic destined for these domains to a controlled domain, thus preventing the propagation of malicious programs such as viruses, ransomware, etc…
– DGA (Domain Generation Algorithm): These are algorithms used to generate a very large number of DNS domains, which are used as rendezvous points between the malware and Command and Control (C2 or C&C). The purpose of DGA is to evade detection and mitigation efforts by security tools and researchers, as traditional blacklisting approaches become less effective when dealing with constantly changing domain names. The DGA algorithm uses a seed input, such as a date, a unique identifier, or a combination of factors, to generate a pseudo-random sequence of characters. For example, the algorithm may generate domain names like “qwer1234abc.com” or “x1yx2yz3.com”. The large list of domain names makes it difficult to block botnet proliferation.
– DNS Fast-flux: This technique combines two DNS functions. Several IP addresses are associated with the same server name and very low TTLs, of the order of 5 seconds. Because the TTL is so low, responses expire rapidly. This generates new resolution requests. Because of Round Robin, DNS servers will respond each time with a different IP address from the one previously sent. DNS Fast Flux is commonly used by botnets, malware, phishing campaigns, and other malicious actors to evade detection, hosting takedown efforts, and blacklisting. By constantly changing the IP addresses associated with a domain name, attackers can maintain resilient communication channels and infrastructure, making it difficult for defenders to disrupt their operations. This technique is very difficult to detect and block.
– DNS Double Fast-Flux: This is an even more twisted variant of DNS Fast-flux, with the same operating principle, except that the fast-flux technique is also applied to DNS servers. This technique is used by cybercriminals to further obfuscate and hide the true location of malicious infrastructure. In DNS Double Fast-Flux, not only are the IP addresses associated with a domain rapidly changed, but the DNS authoritative servers responsible for resolving the domain are also constantly rotated, adding an additional layer of complexity to the evasion technique. The target is even more mobile and therefore harder to stop.
– DNS-based Data Exfiltration Channel: This is a technique for exfiltrating data by encapsulating it in simple DNS Data requests to domains set up expressly for this purpose.
– DNS Tunneling (or Covert Channel VPNs): DNS tunnels are often used to surf the web anonymously, but also to exfiltrate sensitive data. This is achieved by encapsulating data within DNS queries and responses. Instead of using traditional communication protocols like TCP or UDP, DNS tunneling leverages the DNS protocol to create covert communication channels between a client and a remote server, allowing attackers to transmit data undetected. This is often done via DNS requests of type A or TXT records.
– DNS Killswitch: New-generation malware contains “killswitches” that enable its creator to halt its proliferation. The principle is as follows: the malware regularly makes DNS requests on a very long domain name with no semantics. As long as the DNS domain does not exist, the DNS response is negative and the malware continues to proliferate. If the domain in question does exist, the DNS response is positive. The killswitch takes effect and the malware stops. This happened on the WannaCry ransomware, which came to a screeching halt when a researcher accidentally deposited the domain name after analyzing the malware’s code.
– DNS as Malware Control Plan: Over 91% of malware uses DNS both to contact its Command and Control (C&C) center and to exfiltrate data or redirect traffic. DNS is therefore considered the malware’s Control Plan.
– DNS beaconing (or malware beaconing): This refers to the malware’s action of contacting its command and control center at regular intervals to obtain the download of its installation code or instructions for undertaking data exfiltration. Instead of establishing persistent connections or sending large volumes of data, the malware periodically sends small, stealthy DNS queries to specific domain names controlled by the attackers. These DNS queries serve as “beacons” or signals to indicate that the infected device is active and ready to receive instructions or updates from the C2 server. This can be done on HTTP requests, but increasingly on DNS requests such as A records, DNS AAAA records or DNS TXT records.
As we have seen, the techniques for circumventing and abusing the DNS protocol are numerous and increasingly complex. APTs (Advanced Persistent Threats) use a combination of these techniques to gain a foothold and proliferate. DNS is the second most common attack vector on the Internet after HTTP. And DNS is involved in at least 4 of the 7 stages of the Cyber Kill Chain. The delay in deploying DNSSEC (Domain Name System Security Extensions) and the current DNS protocol evolutions with DoH (DNS over HTTP) and DoT (DNS over TLS) are likely to make things even more complex.
About DNSSEC, DoH and DoT
DNSSEC is a set of security extensions to the DNS protocol that adds cryptographic authentication and integrity checks to DNS data. Its primary goal is to address vulnerabilities in the traditional DNS infrastructure and provide mechanisms to ensure the authenticity and integrity of DNS information.
DNS over HTTP (DoH) is a protocol that allows DNS queries and responses to be transmitted over the HTTP protocol, typically using HTTPS (HTTP Secure) for encryption. Traditionally, DNS queries and responses have been transmitted over UDP (User Datagram Protocol) or TCP (Transmission Control Protocol) without encryption, leaving them vulnerable to interception and manipulation. DoH represents a significant advancement in DNS privacy and security, providing a standardized approach for encrypting DNS traffic and protecting user privacy against surveillance and censorship. However, it’s important to note that DoH is not a panacea and may introduce new challenges and considerations, such as DNS-based filtering and parental controls that need to be addressed in deployment and configuration.
DNS over TLS (DoT) is a protocol that encrypts DNS queries and responses using the Transport Layer Security (TLS) protocol. Like DoH, DoT provides a secure and private method for transmitting DNS traffic over the internet, protecting it from interception and manipulation. DoT represents a significant advancement in DNS security and privacy, providing a standardized approach for encrypting DNS traffic and protecting user privacy against surveillance and interception. By leveraging the security features of TLS, DoT offers a robust solution for securing DNS communications over the internet.