Feeds

Blackhole your malware

Block the bad domains

  • alert
  • submit to reddit

Designing a Defense for Mobile Applications

Sysadmin blog Attempting to prevent Malware from infecting computers is an important duty of a systems administrator. If you are attempting to secure systems then anti-malware applications, restricting the use of vulnerable third party applications and browser extensions are all important. But attempting to prevent – or at least contain – malware across an entire network calls for different tactics.

One of the most efficient methods of dealing with malware is DNS black holing. A DNS black hole is simple: identify domains that belong to spammers, host malware, or are otherwise undesirable and block traffic to the sites. DNS black holes can be an elegant part of your network defence.

DNS black holes can prevent being infected by malware that involves a third party application such as Adobe’s Flash or Reader, often combined with cross-site scripting (XSS).

A visit to a website you may trust – such as Facebook.com – contains resources provided by other servers than Facebook.com. Advertisements running on the website may execute a script from another domain. If the XSS call is an attempt to infect you with malware then visiting Facebook could lead to a compromised computer.

DNS black holing would help prevent these attacks. The malicious XSS in would attempt to make a call to the domain containing the malware. Thanks to the DNS black hole, the domain points to a nonexistent location. Similarly, if you do happen to get infected by one of the modern nasties from the internet, DNS black holing helps prevent the malware from connecting to its command and control servers. If the malware can’t call home then it is effectively neutered.

A bonus is that you can add non-malware domains, which company policy dictates employees are not allowed to visit, to your DNS black hole. The caveat to this is that certain internet service providers wised up to this long ago. With Facebook blocking using a DNS black hole is a fairly simple procedure. In other cases, such as gtalk, it’s virtually impossible.

There are many approaches to implementing a DNS black hole. I prefer Malwaredomains.com, who provide a list of domains known to host malware. It is up to you to figure out how you want to integrate it into your network.

The idea is to add the list of malware domains to your DNS server and route them somewhere other than where they are intended. The most popular approach is to route the domains to 127.0.0.1 or ::1. If you get creative you might consider routing them to a honeypot machine on your network that will detect attempts to connect to the domains on the list.

The other major use is to add the list to your firewall; in my case ISA Server 2006. I implemented it after noticing that some of the newer malware had cottoned on to the whole DNS black hole idea. The initial dropper added entries in the local system’s host file so that the malware could always reach its command-and-control servers - even if you black holed them in your DNS. By adding the domains to the firewall there is an extra layer of security. Even if the malware manages to locate an IP address for its command-and-control server, it won’t be able to send packets to it.

I can not recommend DNS black holing enough: specifically I have nothing but praise and admiration for the excellent work carried out by the folks at Malwaredomains.com. I have had malware make it through my defences, but each time the DNS black hole set up using Malwaredomains.com has been my saving grace. DNS black holing, and Malwaredomains.com specifically, is a beautiful example of when an ounce of prevention is worth a pound of cure.

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
Attack of the clones: Oracle's latest Red Hat Linux lookalike arrives
Oracle's Linux boss says Larry's Linux isn't just for Oracle apps anymore
THUD! WD plonks down SIX TERABYTE 'consumer NAS' fatboy
Now that's a LOT of porn or pirated movies. Or, you know, other consumer stuff
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
FLAPE – the next BIG THING in storage
Find cold data with flash, transmit it from tape
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.