3 ms·

Many detection tools do leverage the fact that if there is spike in NXDOMAIN DNS responses, it could be a malware. However such signals are also exhibited by in

Many detection tools do leverage the fact that if there is spike in NXDOMAIN DNS responses, it could be a malware. However such signals are also exhibited by infra issues. This is sort of analogous to cancer detection. Cancers cells are really good at disguising themselves.

inetknght 6y ago
> spike in NXDOMAIN DNS responses NXDOMAIN is watched because known malware has been observed to use it. But I tell you: malware can just as easily utilize a valid DNS response.
- duskwuff 6y ago
  Domain-generation algorithms work along the lines of: seed a random number generator with the current date. Spit out a handful of domain names, and try contacting each of those a couple times each day. This way, the malware isn't tied down to a specific domain or set of domains; the bot herder just has to register any one of the domains in the current day's set, and if they lose the domain, they can repeat the process the next day. The downside is that all the bots will generate a lot of DNS traffic checking for those domains. That's what's being detected here -- the NXDOMAIN responses don't carry any desired data, but the malware can't avoid generating them while it's looking for its owner.
octoberfranklin 6y ago
> spike in NXDOMAIN DNS responses For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated) top level domains. The attacker need only register one of them, and if the domain gets frozen they can often just register another -- until the generator algorithm is integrated into the registrars' blocking system, which takes time and work. Personally I'm surprised we don't see more malware using the various DNS replacements that sit on top of Ethereum. They were using Namecoin for a while.
- sterlind 6y ago
  probably harder to reliably get to Ethereum than to reliably get to any DNS server. for indiscriminately-targeted ransomware Namecoin etc. would make sense, but DNS is a better choice for internal networks.
  - jandrese 6y ago
    Also, security conscious companies would flag a connection to Ethereum as suspicious in itself, so your effort to hide yourself could in fact draw more attention.
    - octoberfranklin 6y ago
      I know; it really depends on the kind of network the malware is deployed into. If it's some quant trading group on wall street, or the Treasury department, using EDNS for CNC would be outstanding camoflauge. If it's some single-purpose server farm then yeah, of course, stands out like a sore thumb.
  - colejohnson66 6y ago
    What about Tor hidden websites? Or would the fact that the URL is a public key (essentially) prevent deterministic randomness without embedding the private key?
syshum 6y ago
Good thing we will have DoH to secure malware from being detected, thanks Mozilla
- _wldu 6y ago
  Network security monitoring and encryption have always been at odds. One day, due to encryption, all that will be left to monitor will be metadata (to, from, date, time, src, dst, bytes, duration, etc.)

inetknght 6y ago

> spike in NXDOMAIN DNS responses NXDOMAIN is watched because known malware has been observed to use it. But I tell you: malware can just as easily utilize a valid DNS response.

duskwuff 6y ago
Domain-generation algorithms work along the lines of: seed a random number generator with the current date. Spit out a handful of domain names, and try contacting each of those a couple times each day. This way, the malware isn't tied down to a specific domain or set of domains; the bot herder just has to register any one of the domains in the current day's set, and if they lose the domain, they can repeat the process the next day. The downside is that all the bots will generate a lot of DNS traffic checking for those domains. That's what's being detected here -- the NXDOMAIN responses don't carry any desired data, but the malware can't avoid generating them while it's looking for its owner.

octoberfranklin 6y ago

> spike in NXDOMAIN DNS responses For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated) top level domains. The attacker need only register one of them, and if the domain gets frozen they can often just register another -- until the generator algorithm is integrated into the registrars' blocking system, which takes time and work. Personally I'm surprised we don't see more malware using the various DNS replacements that sit on top of Ethereum. They were using Namecoin for a while.

sterlind 6y ago
probably harder to reliably get to Ethereum than to reliably get to any DNS server. for indiscriminately-targeted ransomware Namecoin etc. would make sense, but DNS is a better choice for internal networks.
- jandrese 6y ago
  Also, security conscious companies would flag a connection to Ethereum as suspicious in itself, so your effort to hide yourself could in fact draw more attention.
  - octoberfranklin 6y ago
    I know; it really depends on the kind of network the malware is deployed into. If it's some quant trading group on wall street, or the Treasury department, using EDNS for CNC would be outstanding camoflauge. If it's some single-purpose server farm then yeah, of course, stands out like a sore thumb.
- colejohnson66 6y ago
  What about Tor hidden websites? Or would the fact that the URL is a public key (essentially) prevent deterministic randomness without embedding the private key?

syshum 6y ago

Good thing we will have DoH to secure malware from being detected, thanks Mozilla

_wldu 6y ago
Network security monitoring and encryption have always been at odds. One day, due to encryption, all that will be left to monitor will be metadata (to, from, date, time, src, dst, bytes, duration, etc.)