Original URL: http://www.theregister.co.uk/2010/08/13/sysadmin_black_hole/

Blackhole your malware

Block the bad domains

By Trevor Pott

Posted in Servers, 13th August 2010 13:41 GMT

Sysadmin blog Attempting to prevent Malware from infecting computers is an important duty of a systems administrator. If you are attempting to secure systems then anti-malware applications, restricting the use of vulnerable third party applications and browser extensions are all important. But attempting to prevent – or at least contain – malware across an entire network calls for different tactics.

One of the most efficient methods of dealing with malware is DNS black holing. A DNS black hole is simple: identify domains that belong to spammers, host malware, or are otherwise undesirable and block traffic to the sites. DNS black holes can be an elegant part of your network defence.

DNS black holes can prevent being infected by malware that involves a third party application such as Adobe’s Flash or Reader, often combined with cross-site scripting (XSS).

A visit to a website you may trust – such as Facebook.com – contains resources provided by other servers than Facebook.com. Advertisements running on the website may execute a script from another domain. If the XSS call is an attempt to infect you with malware then visiting Facebook could lead to a compromised computer.

DNS black holing would help prevent these attacks. The malicious XSS in would attempt to make a call to the domain containing the malware. Thanks to the DNS black hole, the domain points to a nonexistent location. Similarly, if you do happen to get infected by one of the modern nasties from the internet, DNS black holing helps prevent the malware from connecting to its command and control servers. If the malware can’t call home then it is effectively neutered.

A bonus is that you can add non-malware domains, which company policy dictates employees are not allowed to visit, to your DNS black hole. The caveat to this is that certain internet service providers wised up to this long ago. With Facebook blocking using a DNS black hole is a fairly simple procedure. In other cases, such as gtalk, it’s virtually impossible.

There are many approaches to implementing a DNS black hole. I prefer Malwaredomains.com, who provide a list of domains known to host malware. It is up to you to figure out how you want to integrate it into your network.

The idea is to add the list of malware domains to your DNS server and route them somewhere other than where they are intended. The most popular approach is to route the domains to 127.0.0.1 or ::1. If you get creative you might consider routing them to a honeypot machine on your network that will detect attempts to connect to the domains on the list.

The other major use is to add the list to your firewall; in my case ISA Server 2006. I implemented it after noticing that some of the newer malware had cottoned on to the whole DNS black hole idea. The initial dropper added entries in the local system’s host file so that the malware could always reach its command-and-control servers - even if you black holed them in your DNS. By adding the domains to the firewall there is an extra layer of security. Even if the malware manages to locate an IP address for its command-and-control server, it won’t be able to send packets to it.

I can not recommend DNS black holing enough: specifically I have nothing but praise and admiration for the excellent work carried out by the folks at Malwaredomains.com. I have had malware make it through my defences, but each time the DNS black hole set up using Malwaredomains.com has been my saving grace. DNS black holing, and Malwaredomains.com specifically, is a beautiful example of when an ounce of prevention is worth a pound of cure.