Feeds

Blackhole your malware

Block the bad domains

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

Sysadmin blog Attempting to prevent Malware from infecting computers is an important duty of a systems administrator. If you are attempting to secure systems then anti-malware applications, restricting the use of vulnerable third party applications and browser extensions are all important. But attempting to prevent – or at least contain – malware across an entire network calls for different tactics.

One of the most efficient methods of dealing with malware is DNS black holing. A DNS black hole is simple: identify domains that belong to spammers, host malware, or are otherwise undesirable and block traffic to the sites. DNS black holes can be an elegant part of your network defence.

DNS black holes can prevent being infected by malware that involves a third party application such as Adobe’s Flash or Reader, often combined with cross-site scripting (XSS).

A visit to a website you may trust – such as Facebook.com – contains resources provided by other servers than Facebook.com. Advertisements running on the website may execute a script from another domain. If the XSS call is an attempt to infect you with malware then visiting Facebook could lead to a compromised computer.

DNS black holing would help prevent these attacks. The malicious XSS in would attempt to make a call to the domain containing the malware. Thanks to the DNS black hole, the domain points to a nonexistent location. Similarly, if you do happen to get infected by one of the modern nasties from the internet, DNS black holing helps prevent the malware from connecting to its command and control servers. If the malware can’t call home then it is effectively neutered.

A bonus is that you can add non-malware domains, which company policy dictates employees are not allowed to visit, to your DNS black hole. The caveat to this is that certain internet service providers wised up to this long ago. With Facebook blocking using a DNS black hole is a fairly simple procedure. In other cases, such as gtalk, it’s virtually impossible.

There are many approaches to implementing a DNS black hole. I prefer Malwaredomains.com, who provide a list of domains known to host malware. It is up to you to figure out how you want to integrate it into your network.

The idea is to add the list of malware domains to your DNS server and route them somewhere other than where they are intended. The most popular approach is to route the domains to 127.0.0.1 or ::1. If you get creative you might consider routing them to a honeypot machine on your network that will detect attempts to connect to the domains on the list.

The other major use is to add the list to your firewall; in my case ISA Server 2006. I implemented it after noticing that some of the newer malware had cottoned on to the whole DNS black hole idea. The initial dropper added entries in the local system’s host file so that the malware could always reach its command-and-control servers - even if you black holed them in your DNS. By adding the domains to the firewall there is an extra layer of security. Even if the malware manages to locate an IP address for its command-and-control server, it won’t be able to send packets to it.

I can not recommend DNS black holing enough: specifically I have nothing but praise and admiration for the excellent work carried out by the folks at Malwaredomains.com. I have had malware make it through my defences, but each time the DNS black hole set up using Malwaredomains.com has been my saving grace. DNS black holing, and Malwaredomains.com specifically, is a beautiful example of when an ounce of prevention is worth a pound of cure.

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
Cutting cancer rates: Data, models and a happy ending?
How surgery might be making cancer prognoses worse
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
Forrester says it's time to give up on physical storage arrays
The physical/virtual storage tipping point may just have arrived
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?