SLIDE 1
Chair of Network Architectures and Services Department of Informatics Technical University of Munich
Background
DNS
The DNS query process
- M. Mitterer — pDNS
2
Passive DNS Michael Mitterer October 13, 2017 Chair of Network - - PowerPoint PPT Presentation
Passive DNS Michael Mitterer October 13, 2017 Chair of Network - - PowerPoint PPT Presentation
Chair of Network Architectures and Services Department of Informatics Technical University of Munich Passive DNS Michael Mitterer October 13, 2017 Chair of Network Architectures and Services Department of Informatics Technical University of
SLIDE 2
SLIDE 3
Background
DNS Resource Record
DNS answer querying microsoft.com.
- M. Mitterer — pDNS
3
SLIDE 4
Background
Passive DNS
The Passive DNS attempts
- M. Mitterer — pDNS
4
SLIDE 5
Outline
Usage of Passive DNS
Finding Malicious Domains Enhance Functionality and Availability Monitoring DNS Spying Users
- M. Mitterer — pDNS
5
SLIDE 6
Finding Malicious Domains
Fast-Flux Domains
- Domains of Fast-Flux networks
- Provides
malicious services/phishing networks
- Set of IP addresses changes
The structure of a Fast-Flux network
- M. Mitterer — pDNS
6
SLIDE 7
Finding Malicious Domains
Detection via Passive DNS
Use of Passive DNS to detect Fast-Flux domains
⇒ Big amount of DNS traffic
- M. Mitterer — pDNS
7
SLIDE 8
Finding Malicious Domains
Basic tool structure using the example of FluxBuster
Structure of FluxBuster
Basic structure:
- Capture DNS traffic passively
- Filter traffic
- Cluster domains
- Classify clusters
Advantages [3]: → 64.5% of malicious domains were detected earlier than using other methods → 62% of flux agent IPs were previously unknown
- M. Mitterer — pDNS
8
SLIDE 9
Finding Malicious Domains
Fast Flux Monitor
Architecture of Fast Flux Monitor
Aim: → Decide whether a given domain is a Fast-Flux domain Advantages: → Detection rate of 96.6% [2]
- M. Mitterer — pDNS
9
SLIDE 10
Finding Malicious Domains
EXPOSURE Aim: → Finding different kinds of malicious domains “in the wild” Scientific contribution [1]: → Experiment run from December 28, 2010 over 17 months → Early detection of malicious domains (>50% only detected by EXPOSURE) → Identified 200 new malicious domains per day → Most malicious domains belonged to .info, .org, or .biz TLDs → Most malicious domains were hosted in US, Germany, or South Korea
- M. Mitterer — pDNS
10
SLIDE 11
Enhance Functionality and Availability
Improving DNS
- Enhance Availability
- Monitoring DNS
- M. Mitterer — pDNS
11
SLIDE 12
Enhance Functionality and Availability
Enhance Availability
Passive DNS Replication
Disadvantages: → Long time until all records are replicated → Inconsistency
- M. Mitterer — pDNS
12
SLIDE 13
Enhance Functionality and Availability
Monitoring DNS
Monitor DNS usage
- M. Mitterer — pDNS
13
SLIDE 14
Spying Users
Privacy Problems - EDNS
Transmitted information with EDNS
- M. Mitterer — pDNS
14
SLIDE 15
Spying Users
Privacy Problems - QNAME minimization
Transmitted information using QNAME minimization
- M. Mitterer — pDNS
15
SLIDE 16
Spying Users
Solutions DNSSEC: Not encrypted ⇒ Traffic readable ⇒ Traffic has to be encrypted:
- DNSCrypt
- DNS Privacy Project
- DNS over TLS
- M. Mitterer — pDNS
16
SLIDE 17
Conclusion
Conclusion Passive DNS...
- ... can make the Internet more secure
- ... improves DNS
- ... leads to huge privacy issues
- M. Mitterer — pDNS
17
SLIDE 18
Questions?
Questions?
- M. Mitterer — pDNS
18
SLIDE 19
Backup
Privacy Problems
Extract of a DNS query requesting in.tum.de
- M. Mitterer — pDNS
19
SLIDE 20
Bibliography
[1]
- L. Bilge, S. Sen, D. Balzarotti, E. Kirda, and C. Kruegel.
Exposure: a Passive DNS Analysis Service to Detect and Report Malicious Domains. ACM Transactions on Information and System Security, 16(4):14:1–14:28, Apr. 2014. [2]
- A. Caglayan, M. Toothaker, D. Drapeau, D. Burke, and G. Eaton.
Real-Time Detection of Fast Flux Service Networks. In Conference for Homeland Security, 2009. CATCH’09. Cybersecurity Applications & Technology, pages 285–292. IEEE, 2009. [3]
- R. Perdisci, I. Corona, and G. Giacinto.
Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis. IEEE Transactions on Dependable and Secure Computing, 9(5):714–726, 2012.
- M. Mitterer — pDNS
20