Feeds

Blackhole your malware

Block the bad domains

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Sysadmin blog Attempting to prevent Malware from infecting computers is an important duty of a systems administrator. If you are attempting to secure systems then anti-malware applications, restricting the use of vulnerable third party applications and browser extensions are all important. But attempting to prevent – or at least contain – malware across an entire network calls for different tactics.

One of the most efficient methods of dealing with malware is DNS black holing. A DNS black hole is simple: identify domains that belong to spammers, host malware, or are otherwise undesirable and block traffic to the sites. DNS black holes can be an elegant part of your network defence.

DNS black holes can prevent being infected by malware that involves a third party application such as Adobe’s Flash or Reader, often combined with cross-site scripting (XSS).

A visit to a website you may trust – such as Facebook.com – contains resources provided by other servers than Facebook.com. Advertisements running on the website may execute a script from another domain. If the XSS call is an attempt to infect you with malware then visiting Facebook could lead to a compromised computer.

DNS black holing would help prevent these attacks. The malicious XSS in would attempt to make a call to the domain containing the malware. Thanks to the DNS black hole, the domain points to a nonexistent location. Similarly, if you do happen to get infected by one of the modern nasties from the internet, DNS black holing helps prevent the malware from connecting to its command and control servers. If the malware can’t call home then it is effectively neutered.

A bonus is that you can add non-malware domains, which company policy dictates employees are not allowed to visit, to your DNS black hole. The caveat to this is that certain internet service providers wised up to this long ago. With Facebook blocking using a DNS black hole is a fairly simple procedure. In other cases, such as gtalk, it’s virtually impossible.

There are many approaches to implementing a DNS black hole. I prefer Malwaredomains.com, who provide a list of domains known to host malware. It is up to you to figure out how you want to integrate it into your network.

The idea is to add the list of malware domains to your DNS server and route them somewhere other than where they are intended. The most popular approach is to route the domains to 127.0.0.1 or ::1. If you get creative you might consider routing them to a honeypot machine on your network that will detect attempts to connect to the domains on the list.

The other major use is to add the list to your firewall; in my case ISA Server 2006. I implemented it after noticing that some of the newer malware had cottoned on to the whole DNS black hole idea. The initial dropper added entries in the local system’s host file so that the malware could always reach its command-and-control servers - even if you black holed them in your DNS. By adding the domains to the firewall there is an extra layer of security. Even if the malware manages to locate an IP address for its command-and-control server, it won’t be able to send packets to it.

I can not recommend DNS black holing enough: specifically I have nothing but praise and admiration for the excellent work carried out by the folks at Malwaredomains.com. I have had malware make it through my defences, but each time the DNS black hole set up using Malwaredomains.com has been my saving grace. DNS black holing, and Malwaredomains.com specifically, is a beautiful example of when an ounce of prevention is worth a pound of cure.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ellison: Sparc M7 is Oracle's most important silicon EVER
'Acceleration engines' key to performance, security, Larry says
Linux? Bah! Red Hat has its eye on the CLOUD – and it wants to own it
CEO says it will be 'undisputed leader' in enterprise cloud tech
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
Hey, what's a STORAGE company doing working on Internet-of-Cars?
Boo - it's not a terabyte car, it's just predictive maintenance and that
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.