Feeds

Blackhole your malware

Block the bad domains

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Sysadmin blog Attempting to prevent Malware from infecting computers is an important duty of a systems administrator. If you are attempting to secure systems then anti-malware applications, restricting the use of vulnerable third party applications and browser extensions are all important. But attempting to prevent – or at least contain – malware across an entire network calls for different tactics.

One of the most efficient methods of dealing with malware is DNS black holing. A DNS black hole is simple: identify domains that belong to spammers, host malware, or are otherwise undesirable and block traffic to the sites. DNS black holes can be an elegant part of your network defence.

DNS black holes can prevent being infected by malware that involves a third party application such as Adobe’s Flash or Reader, often combined with cross-site scripting (XSS).

A visit to a website you may trust – such as Facebook.com – contains resources provided by other servers than Facebook.com. Advertisements running on the website may execute a script from another domain. If the XSS call is an attempt to infect you with malware then visiting Facebook could lead to a compromised computer.

DNS black holing would help prevent these attacks. The malicious XSS in would attempt to make a call to the domain containing the malware. Thanks to the DNS black hole, the domain points to a nonexistent location. Similarly, if you do happen to get infected by one of the modern nasties from the internet, DNS black holing helps prevent the malware from connecting to its command and control servers. If the malware can’t call home then it is effectively neutered.

A bonus is that you can add non-malware domains, which company policy dictates employees are not allowed to visit, to your DNS black hole. The caveat to this is that certain internet service providers wised up to this long ago. With Facebook blocking using a DNS black hole is a fairly simple procedure. In other cases, such as gtalk, it’s virtually impossible.

There are many approaches to implementing a DNS black hole. I prefer Malwaredomains.com, who provide a list of domains known to host malware. It is up to you to figure out how you want to integrate it into your network.

The idea is to add the list of malware domains to your DNS server and route them somewhere other than where they are intended. The most popular approach is to route the domains to 127.0.0.1 or ::1. If you get creative you might consider routing them to a honeypot machine on your network that will detect attempts to connect to the domains on the list.

The other major use is to add the list to your firewall; in my case ISA Server 2006. I implemented it after noticing that some of the newer malware had cottoned on to the whole DNS black hole idea. The initial dropper added entries in the local system’s host file so that the malware could always reach its command-and-control servers - even if you black holed them in your DNS. By adding the domains to the firewall there is an extra layer of security. Even if the malware manages to locate an IP address for its command-and-control server, it won’t be able to send packets to it.

I can not recommend DNS black holing enough: specifically I have nothing but praise and admiration for the excellent work carried out by the folks at Malwaredomains.com. I have had malware make it through my defences, but each time the DNS black hole set up using Malwaredomains.com has been my saving grace. DNS black holing, and Malwaredomains.com specifically, is a beautiful example of when an ounce of prevention is worth a pound of cure.

Beginner's guide to SSL certificates

More from The Register

next story
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
BOFH: WHERE did this 'fax-enabled' printer UPGRADE come from?
Don't worry about that cable, it's part of the config
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.