4 ms·

A big takeaway here is that telemetry is a security threat. If your application is pushing opaque regular traffic out for not adequate reasons you are providing

A big takeaway here is that telemetry is a security threat. If your application is pushing opaque regular traffic out for not adequate reasons you are providing a good cover for malware activity. Even a fresh Windows install these days has so much regular network activity for telemetry and other services, it's trivial to hide bad behavior.

deleted 6y ago
[deleted]
gauravphoenix 6y ago
Many detection tools do leverage the fact that if there is spike in NXDOMAIN DNS responses, it could be a malware. However such signals are also exhibited by infra issues. This is sort of analogous to cancer detection. Cancers cells are really good at disguising themselves.
- inetknght 6y ago
  > spike in NXDOMAIN DNS responses NXDOMAIN is watched because known malware has been observed to use it. But I tell you: malware can just as easily utilize a valid DNS response.
  - duskwuff 6y ago
    Domain-generation algorithms work along the lines of: seed a random number generator with the current date. Spit out a handful of domain names, and try contacting each of those a couple times each day. This way, the malware isn't tied down to a specific domain or set of domains; the bot herder just has to register any one of the domains in the current day's set, and if they lose the domain, they can repeat the process the next day. The downside is that all the bots will generate a lot of DNS traffic checking for those domains. That's what's being detected here -- the NXDOMAIN responses don't carry any desired data, but the malware can't avoid generating them while it's looking for its owner.
- octoberfranklin 6y ago
  > spike in NXDOMAIN DNS responses For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated) top level domains. The attacker need only register one of them, and if the domain gets frozen they can often just register another -- until the generator algorithm is integrated into the registrars' blocking system, which takes time and work. Personally I'm surprised we don't see more malware using the various DNS replacements that sit on top of Ethereum. They were using Namecoin for a while.
  - sterlind 6y ago
    probably harder to reliably get to Ethereum than to reliably get to any DNS server. for indiscriminately-targeted ransomware Namecoin etc. would make sense, but DNS is a better choice for internal networks.
    - jandrese 6y ago
      Also, security conscious companies would flag a connection to Ethereum as suspicious in itself, so your effort to hide yourself could in fact draw more attention.
      - octoberfranklin 6y ago
        I know; it really depends on the kind of network the malware is deployed into. If it's some quant trading group on wall street, or the Treasury department, using EDNS for CNC would be outstanding camoflauge. If it's some single-purpose server farm then yeah, of course, stands out like a sore thumb.
    - colejohnson66 6y ago
      What about Tor hidden websites? Or would the fact that the URL is a public key (essentially) prevent deterministic randomness without embedding the private key?
- syshum 6y ago
  Good thing we will have DoH to secure malware from being detected, thanks Mozilla
  - _wldu 6y ago
    Network security monitoring and encryption have always been at odds. One day, due to encryption, all that will be left to monitor will be metadata (to, from, date, time, src, dst, bytes, duration, etc.)
mtkd 6y ago
It is only a threat if it can be leveraged. Deeper heuristics on the deviations in that telemetry from normal could also have provided a signal that something was off -- like the temporary file replacement activity. Without telemetry that kind of activity could likely continue undetected for longer.
new23d 6y ago
Even Ubuntu's pollinate client takes some liberties. See the article at [1] documenting the info it sends to the mothership. [1] https://news.ycombinator.com/item?id=25346991 https://news.ycombinator.com/item?id=25346991
- jlgaddis 6y ago
  It seems you missed an opportunity (BTW, is that what they call "content marketing"?). Had you left your VM running a little while longer, you might've noticed something else in your Netflow data: yet another service calling home to Canonical twice a day. I wish I were joking about this but... the (likely) "primary" reason for this is so that they can show ads to users when they log in -- ads for things like TV shows or software for other operating systems or, sometimes, just a "fun fact". I can't really say it's the only reason, however. With all of the system information they're getting off of each host, there's now several different things they can use it for and, of course, that provides them with even more motivation to keep doing it! This isn't a new thing, though. In fact, people have been expressing their "unhappiness" about it to Canonical for a few years now [0,1,2]. Unfortunately: - it's still installed by default - it's still enabled by default - they've actually increased the amount of system info that they're collecting [3] - it's installed as part of the "base-files" package -- an "essential" package which cannot be removed! - "it's a 'feature', not a bug" (so we absolutely should not expect it to get removed) - apparently, a 42 line MOTD [4] is perfectly acceptable I suppose there's one "positive" thing I can say about it: at least they're using TLS to encrypt the data over the wire. :/ -- If you want to disable this spyware on your Ubuntu hosts, change "ENABLED" to "0" in /etc/default/motd-news: $ sudo sed -i -e '/^ENABLED=1$/s/1/0/' /etc/default/motd-news When executed, /etc/update-motd.d/50-motd-news checks if "ENABLED" is set to "1". If not, it exits without calling home. 50-motd-news gets launched by motd-news.service which itself is activated -- twice per day -- by motd-news.timer. Since I like to be thorough, I recommend running a few more commands (as it's impossible to know that Canonical won't change any of this in the future!): $ sudo systemctl mask --now motd-news.service $ sudo systemctl mask --now motd-news.timer $ sudo systemctl clean --what=state motd-news.timer $ sudo rm -f /var/cache/motd-news That should do it. If you're rather not have to worry about something like this in the future, you may want to consider replacing Ubuntu Linux with Debian GNU/Linux. -- [0]: https://news.ycombinator.com/item?id=14662088 https://news.ycombinator.com/item?id=14662088 [1]: https://old.reddit.com/r/linux/comments/98ctgu/ubuntu_server_including_ads_in_the_terminal/ https://old.reddit.com/r/linux/comments/98ctgu/ubuntu_server... [2]: https://dev.to/fivnex/open-letter-to-canonical-ltd-a1k https://dev.to/fivnex/open-letter-to-canonical-ltd-a1k [3]: https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1840946 https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/18... [4]: https://joe.schafer.dev/chatty-ubuntu-motd/ https://joe.schafer.dev/chatty-ubuntu-motd/

deleted 6y ago

[deleted]

gauravphoenix 6y ago

Many detection tools do leverage the fact that if there is spike in NXDOMAIN DNS responses, it could be a malware. However such signals are also exhibited by infra issues. This is sort of analogous to cancer detection. Cancers cells are really good at disguising themselves.

inetknght 6y ago
> spike in NXDOMAIN DNS responses NXDOMAIN is watched because known malware has been observed to use it. But I tell you: malware can just as easily utilize a valid DNS response.
- duskwuff 6y ago
  Domain-generation algorithms work along the lines of: seed a random number generator with the current date. Spit out a handful of domain names, and try contacting each of those a couple times each day. This way, the malware isn't tied down to a specific domain or set of domains; the bot herder just has to register any one of the domains in the current day's set, and if they lose the domain, they can repeat the process the next day. The downside is that all the bots will generate a lot of DNS traffic checking for those domains. That's what's being detected here -- the NXDOMAIN responses don't carry any desired data, but the malware can't avoid generating them while it's looking for its owner.
octoberfranklin 6y ago
> spike in NXDOMAIN DNS responses For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated) top level domains. The attacker need only register one of them, and if the domain gets frozen they can often just register another -- until the generator algorithm is integrated into the registrars' blocking system, which takes time and work. Personally I'm surprised we don't see more malware using the various DNS replacements that sit on top of Ethereum. They were using Namecoin for a while.
- sterlind 6y ago
  probably harder to reliably get to Ethereum than to reliably get to any DNS server. for indiscriminately-targeted ransomware Namecoin etc. would make sense, but DNS is a better choice for internal networks.
  - jandrese 6y ago
    Also, security conscious companies would flag a connection to Ethereum as suspicious in itself, so your effort to hide yourself could in fact draw more attention.
    - octoberfranklin 6y ago
      I know; it really depends on the kind of network the malware is deployed into. If it's some quant trading group on wall street, or the Treasury department, using EDNS for CNC would be outstanding camoflauge. If it's some single-purpose server farm then yeah, of course, stands out like a sore thumb.
  - colejohnson66 6y ago
    What about Tor hidden websites? Or would the fact that the URL is a public key (essentially) prevent deterministic randomness without embedding the private key?
syshum 6y ago
Good thing we will have DoH to secure malware from being detected, thanks Mozilla
- _wldu 6y ago
  Network security monitoring and encryption have always been at odds. One day, due to encryption, all that will be left to monitor will be metadata (to, from, date, time, src, dst, bytes, duration, etc.)

mtkd 6y ago

It is only a threat if it can be leveraged. Deeper heuristics on the deviations in that telemetry from normal could also have provided a signal that something was off -- like the temporary file replacement activity. Without telemetry that kind of activity could likely continue undetected for longer.

new23d 6y ago

Even Ubuntu's pollinate client takes some liberties. See the article at [1] documenting the info it sends to the mothership. [1] https://news.ycombinator.com/item?id=25346991 https://news.ycombinator.com/item?id=25346991

jlgaddis 6y ago
It seems you missed an opportunity (BTW, is that what they call "content marketing"?). Had you left your VM running a little while longer, you might've noticed something else in your Netflow data: yet another service calling home to Canonical twice a day. I wish I were joking about this but... the (likely) "primary" reason for this is so that they can show ads to users when they log in -- ads for things like TV shows or software for other operating systems or, sometimes, just a "fun fact". I can't really say it's the only reason, however. With all of the system information they're getting off of each host, there's now several different things they can use it for and, of course, that provides them with even more motivation to keep doing it! This isn't a new thing, though. In fact, people have been expressing their "unhappiness" about it to Canonical for a few years now [0,1,2]. Unfortunately: - it's still installed by default - it's still enabled by default - they've actually increased the amount of system info that they're collecting [3] - it's installed as part of the "base-files" package -- an "essential" package which cannot be removed! - "it's a 'feature', not a bug" (so we absolutely should not expect it to get removed) - apparently, a 42 line MOTD [4] is perfectly acceptable I suppose there's one "positive" thing I can say about it: at least they're using TLS to encrypt the data over the wire. :/ -- If you want to disable this spyware on your Ubuntu hosts, change "ENABLED" to "0" in /etc/default/motd-news: $ sudo sed -i -e '/^ENABLED=1$/s/1/0/' /etc/default/motd-news When executed, /etc/update-motd.d/50-motd-news checks if "ENABLED" is set to "1". If not, it exits without calling home. 50-motd-news gets launched by motd-news.service which itself is activated -- twice per day -- by motd-news.timer. Since I like to be thorough, I recommend running a few more commands (as it's impossible to know that Canonical won't change any of this in the future!): $ sudo systemctl mask --now motd-news.service $ sudo systemctl mask --now motd-news.timer $ sudo systemctl clean --what=state motd-news.timer $ sudo rm -f /var/cache/motd-news That should do it. If you're rather not have to worry about something like this in the future, you may want to consider replacing Ubuntu Linux with Debian GNU/Linux. -- [0]: https://news.ycombinator.com/item?id=14662088 https://news.ycombinator.com/item?id=14662088 [1]: https://old.reddit.com/r/linux/comments/98ctgu/ubuntu_server_including_ads_in_the_terminal/ https://old.reddit.com/r/linux/comments/98ctgu/ubuntu_server... [2]: https://dev.to/fivnex/open-letter-to-canonical-ltd-a1k https://dev.to/fivnex/open-letter-to-canonical-ltd-a1k [3]: https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/1840946 https://bugs.launchpad.net/ubuntu/+source/base-files/+bug/18... [4]: https://joe.schafer.dev/chatty-ubuntu-motd/ https://joe.schafer.dev/chatty-ubuntu-motd/