This is _too_ Beautiful to ignore

Printable View

March 4th, 2005, 08:22 PM
Tiger Shark

This is _too_ Beautiful to ignore

Source: Here.

Stop Malware with DNS.....

Imagine trying to add all the primary zones that you can find that are sources of spyware/malware into your DNS servers so that they resolve those bad domains to 127.0.0.1, (or anywhere other than the actual site). It would just be too much work. As the article above describes there is a nice easy way to do it and it works soooo nicely and takes less then 30 minutes.

The article discusses doing this on your primary DNS servers. We all know that the primary DNS servers in a Windows AD domain are the AD controllers themselves and that the DNS is held within the registry. He suggests that you can do this with AD but that you need to change your domain DNS from "AD Integrated" to "Standard Primary" in order to make this work since the zones need to be loaded from file. If you are a Win200X admin like me the thought of messing with the domain DNS is a lot like looking for a gas leak with a match...... :eek: But all is not lost.

Properly managed DNS in an AD domain should be what is known as split or double DNS. The AD servers should be entirely internal and access to them from the internet should be blocked. These servers should contain both the public and private information about your domain. They should be set to use forwarders and the forwarders should be your public DNS servers located in the DMZ. They should be the only machines allowed to make outbound DNS requests and should only be allowed to make their requests from the public servers in the DMZ to keep their existence hidden. The public DNS servers should only hold your public records and no private information about internal hosts. These public DNS servers should be allowed to make requests from anywhere on the internet and resolve addresses of your public domain resources to any location on the internet.

With that system in place you can quite happily implement the suggestions in the article. It works very nicely and therefore kills access to some 2470 domains, (not just web pages but entire domains and all their subdomains). Be aware that if the IP address of the domain is hard-coded then the domain will still be contacted but the use of domain names is common so that blocking IP's at the firewall can be rendered ineffective by changing the IP which would still be resolved by DNS.

Note of warning: The DNS boot file available for download currently contains two errors that prevent the DNS service from starting. They are both instances where the domain name begins with a ", (double quote), just search for them and remove them.

I really like this.... nicely creative..... :D
March 4th, 2005, 08:40 PM
MrCoffee

Ya good love it, SWEEET post TS!
March 4th, 2005, 10:57 PM
nodoze

Keep your AD integrated zones

I just add entries to my host file on the DCs. I make entries that redirect affected/infected computers to one of my freebsd boxes running tcpdump. I just look at the log and I know which boxes have issues that must be addressed. I couldn't bring myself to get rid of the AD integrated zones since they haven't given me any trouble.
March 4th, 2005, 11:24 PM
Tiger Shark

Quote:

I know which boxes have issues that must be addressed.

Er... What issue? They can't find the real target.... No issue!

The article points out that you can redirect the DNS resoltion to a box that logs the attempts.... I chose the 127.0.0.1 for the following reasons:-

1. I'm still testing it but is seems to work fine
2. As I said above there's no issue
3. I don't want to be monitoring something else too.
4. I can change it later if I want to..... Which I probably will when I determine that it is working sufficiently well to begin to think that I am "beating" spyware in my domains so that I can clean up the remaining boxes that are infected.

I know one thing..... Since I turned it on I haven't seen a single Bleeding Snort Malware rule trigger.... Now that's nice.... My IDS has gone almost silent.... puuuurfect..... ;)
March 4th, 2005, 11:40 PM
nodoze

Issues

Say you start a new job and the first day on the job, you see that many computers are infected with spybot.sd. You must stop the beating against the firewall NOW!!! It is much faster to write a script to adjust all the global dcs to point to certain boxes that will log the attempts for you to clean up. As far as preventing installation or connection to these malware sites, it's a good plan you have although, I think redoing DNS just for this issue may not be the best. If the IDS is quite, it may not mean that computers aren't infected.
March 5th, 2005, 12:06 AM
Tiger Shark

Nodoze:

Oh C'mon.... If spybot.sd is that bad it takes 2 seconds to create a primary zone in your AD integrated to redirect them... Done... No writing of scripts.... You could also block the IP's at the firewall.... A single issue isn't an issue..... It's the thousands of "issues" that I'm looking at....

I gave you a nice quick way to defeat some 2500 "issues" from removing the need to change your AD DNS from integrated... (The RIGHT way), to Standard Primary, (the risky/WRONG way), that I found out there that someone smarter then me came up with that, in a properly set up DNS system, I adapted a little..... If you don't want to use it or if you think that you have a better way take it up with him, not me, or just do your own thing, it's fine by me....

Do you use the Bleeding Snort Malware rules? Didn't think so.... Trust me... It makes the IDS's go much quieter.... Remember, (or learn, since we don't know each other), I manage domains I have _no_ control over.... A quiet IDS where malware is concerned is a beautiful thing......
March 5th, 2005, 04:43 AM
ric-o

TS: great post...this is a SWEET solution. My engineers and I started down this path but went down another path which involved implementing a proxy server to _fix_ other issues (pron, gaming, etc) and we didnt fully vet it out like this doc does. Never got funding for the proxy software (Websense).

We have been using MVPS.org hosts file for _problem users_ (re.; admin assistants, tech support, sales people) who get infected with spyware but it's time consuming to setup (we do use an AT job and WGET to regularly update the file) and not scalable.

I'm gonna check this out next week I think....sweet.

It sounds like nodoze just wants to know when a machine is infected so it can be cleaned...however I agree with you: if it cant call _home_ it's a benign infection...we have bigger _fish_ to fry than worry about these neutered critters :)

Thanks again!
March 7th, 2005, 02:17 PM
Tiger Shark

Heh....

Until Friday, over the previous month, my Bleeding Edge Log Analysis file ran an average of about 8-10kb per day which equates to about 30-40 detections per day by the Bleeding Snort Malware rules.

For Saturday and Sunday my log analysis report indicates "BleedingEdge.txt ****Zero Length **** Deleted at 00:13:27"

Now I _really_, _really_ like that.... :cool:
March 7th, 2005, 04:22 PM
ShippMA

Hi Tiger Shark,

I am a novice home user and have been looking for a way to block sites and domains. (my home network is a wireless router hooked up to a broadband modem, quite basic) now i have filled up the filters on the router and have been trying to find other ways to blovk more.

To cut a long story short after reading the file you linked to origionally it mentioned that home users use the Host file a lot, which after a google search led me to this site:

http://accs-net.com/hosts/

I have now decided to implement a a host file, (taken from this site as they update with new adservers every couple of months) edexter to provide a page for 127.0.0.1 and DNSkong to block some more broad adresses.

In short THAN YOU SO MUCH for this post as although the actual content is slighlty beyond my understanding it has led me to a site that suits my needs perfectly.

Additionally if anyone reading this has used edexter and DNSkong and has any tips or come across and adverse effects then please let me know by PM (don't post here so as not to hi-jack the thread).

Thanks again

Matt
March 7th, 2005, 07:12 PM
phishphreek

I just setup a test server for this today. So far its working perfectly!

One question... how are you going to keep it updated?
March 7th, 2005, 07:28 PM
fraggin

Thanks A lot Tigershark.... Now I have something to do :) ..
I looked on my 2003 Domain Controller and found the Boot file under winnt\system32\dns\samples ....
This looks real promising.... Trying to determine if I should do it on the primary or backup DC......
March 7th, 2005, 07:34 PM
Tiger Shark

I'm figuring that I will have to do it manually unless this chap updates his list.

Matt Jonkman at Bleeding Snort implied that he was going to make rules for all the domains in there. My guess is that at somepoint Bleeding Snort's list will match this one. Then, after that, whatever Bleeding Snort adds would be a candidate for the DNS.
March 7th, 2005, 07:43 PM
phishphreek

Quote:

Originally posted here by fraggin
Thanks A lot Tigershark.... Now I have something to do :) ..
I looked on my 2003 Domain Controller and found the Boot file under winnt\system32\dns\samples ....
This looks real promising.... Trying to determine if I should do it on the primary or backup DC......

Make sure to read the DOCs before you do this. The winnt\system32\dns\samples is not the boot file you want. You have to change over from registry to file and a new boot file will be created and put in winnt\system32\dns\

I didn't have the problem that TS had with the " before 2 entries... so maybe its already updated?
I'll grab a copy and check it from time to time to see if it has changed.

It was actually a pretty easy setup. :)

One thing I'm wondering... at the end of the page, it says
"If you are using a rpoxy server, then be careful about using 127.0.0.1, which may overload the proxy."

Why would it overload the proxy?

If a source queries a dns server which points them to 127.0.0.1, it will simply try to connect to itself.

Unless... the proxy is handling the web requests first and then the proxy will query the dns servers and resolve to localhost on itself. In this case using 0.0.0.0 would be better than using 127.0.0.1.
March 7th, 2005, 10:12 PM
phishphreek

Quote:

The article discusses doing this on your primary DNS servers. We all know that the primary DNS servers in a Windows AD domain are the AD controllers themselves and that the DNS is held within the registry. He suggests that you can do this with AD but that you need to change your domain DNS from "AD Integrated" to "Standard Primary" in order to make this work since the zones need to be loaded from file. If you are a Win200X admin like me the thought of messing with the domain DNS is a lot like looking for a gas leak with a match...... But all is not lost.

I was wondering if one can just create a DNS server that is not a AD Integrated DNS server but just a standard primary, and then forward the AD Integrated DNS servers to the DNS server(s) you setup just for the spyware lookups. Then the forwarders can go out to your public DNS servers.

Or... would that just be more overhead and a waste of resources than is needed?
March 7th, 2005, 10:42 PM
Tiger Shark

Phish: That's _effectively_ what I did. I used my public servers that are only standard primaries and secondaries for my public domain resources. My internal services use those as forwarders and are not allowed to contact the root servers themselves. Thus, if a domain is requested internally the AD servers ask the public DNS servers for resolution. If you were silly enough to use my public DNS servers to resolve coolwebsearch.com then you will get 127.0.0.1.... Frankly, if you are silly enough to use my DNS servers rather than the servers the root servers point to for those domains then it's your silly fault if you can't get to your spyware.... :D

So your thought of an additional DNS server is good. Put it in the DMZ and only allow it to house public records for your domain and you would have a nice split DNS setup like mine which, in the long run, is more secure. It can't be conned into giving up information about my internal zones because it has no idea of the structure.
March 7th, 2005, 10:53 PM
phishphreek

Yeah, I thought it would be a better setup. However, I have no public servers on my network, so there is no need to put them in the DMZ?

One thing that I'm worried about though...

From my previous post...

Quote:

One thing I'm wondering... at the end of the page, it says
"If you are using a rpoxy server, then be careful about using 127.0.0.1, which may overload the proxy."

Why would it overload the proxy?

If a source queries a dns server which points them to 127.0.0.1, it will simply try to connect to itself.

Unless... the proxy is handling the web requests first and then the proxy will query the dns servers and resolve to localhost on itself. In this case using 0.0.0.0 would be better than using 127.0.0.1.

I guess the only way to find out who is contacting the DNS servers is to sniff it.
Or... I can just check out the logs. I'm not responsible for the DNS servers or the proxy... so I really had no reason to think about it before.

I never really paid attention to find out if it is the clients who are resolving via dns and the proxy grabs the page, or if the proxy is resolving and grabbing the pages.

I surely don't want to overload the proxy servers by constantly referring them to localhost.

Any insight?

My instinct tells me that the clients are resolving and then the proxy is serving the pages. I say this because there is a different set of DNS addresses in my proxy and is not pointed to the test server. If I just try to pull up any spyware page/domain, it rejects because it is pointing back to my machine which has no HTTP servers running.
March 7th, 2005, 11:02 PM
Tiger Shark

Dunno... never used a proxy... But yeah, on a large network with a "healthy" infestation it could cause an issue i suppose.

OTOH, I have 650 workstations and while I have done some cleanup and prevention stuff my Bleeding Snort malware logs were only showing 30-40 detections a day. So, let's assume I'm only detecting 1/10th of all the malware.... That's 400/day at worst... What <10/hour? So, if you have done some prior cleanup and prevention I would suggest that the load wouldn't be that high with 650 workstations on the network.

I'd be inclined to warn the owners of the proxy server(s) that you are going to try it and then have them monitor. If it causes an issue it's pretty easy to reverse - just remove all the pointers to the domains from the Boot file.
March 8th, 2005, 07:34 AM
phishphreek

TS: One you may want to add that is part of that DNS cache poisioning.

From http://isc.sans.org/diary.php?date=2005-03-04

7sir7.com

7sir.com is already in there along with the other two they reference... 123xxl.com and abx4.com
March 9th, 2005, 12:44 AM
ric-o

This is GREAT! We have put this up at work and it rocks...works as advertised.

I also threw together a quick Perl script which pulls down a spyware hosts file from MVPS.org, parses it and creates a zone file with the domains contained in the file. It also checks for and throws away duplicates comparing against the existing zones in the BleedingSnort file. It's very basic and I'm not an experienced Perl scripter at all...so you have permission to laugh at some of the code inefficiencies...lol. Hey, it works at least. Also, very very little documentation since it was thrown together quickly.

One enhancement could be to simply add the MVPS.org domains to the existing BleedingSnort zones file rather than creating a new one as this script does.

Enjoy.
March 16th, 2005, 01:53 AM
dglosser

I'm reading this thread with great interest since I'm one the people who originally put the DNS Black-Hole file together ;)

A few comments:
-Someone told me that a proxy serverwill connect back to itself if everything resolves to 127.0.0.1, and may overload itself.
- If anyone can write up special instructions or comments about running this in active directory, I'd be happy to post it on the bleeding snort web site.
- I purposely left out the mvps list (and others) since it contains many *ad servers*, which most corporations may not want to block
-I'm adding about 1500 CoolWebSearch domains within the next day or two.
-I just noticed the problem with the space on the first line, I'll fix this as soon as I can.
-I believe you can use something like "wget" (http://www.interlog.com/~tcharron/wgetwin.html) to download the file as a scheduled task ("wget http://www.bleedingsnort.com/blackhole-dns/files/BOOT" )

The files are in something called CVS, so there should be a CVS app which downloads only the modifications and then changes the main file (to avoid a big download). Personally, I always download these things manually (after making a few backup copies) since if there's a mistake in the file then you've hosed your DNS server...

Thanks for testing the zone file. If you get a chance, please post comments to the bleedingsnort malware forum!
March 16th, 2005, 05:25 AM
dglosser

I just added approx. 1500 domains associated with CoolWebSearch (from http://www.spywareinfo.com/~merijn/junk/cws_domains.txt) and Rogue Anti-Spyware (http://www.spywarewarrior.com/rogue_anti-spyware.htm).

Please test as the zonefile now contains approx 3800 zones (about half of which are associated with CoolWebSearch).

Thanks!
March 16th, 2005, 05:52 AM
ric-o

Quote:

Originally posted here by dglosser
I'm reading this thread with great interest since I'm one the people who originally put the DNS Black-Hole file together ;)
-I'm adding about 1500 CoolWebSearch domains within the next day or two.

Oh cool....thanks for all your work - good work there! It works fabulously. Thanks for adding CWS!

Quote:

- I purposely left out the mvps list (and others) since it contains many *ad servers*, which most corporations may not want to block

Yeah but we dont care if our users cant get ads. You do have to be carefull because there are a couple AOL servers on the MVPS list and couple others that might affect valid traffic. An engineer who works for me is modifying my Perl script to remove the hostname off the domain. This is also an effort to reduce the number of domains that need added. We're examining the list closely.
March 16th, 2005, 06:01 AM
phishphreek

I couldn't get your new file to work. I thought the file was too big...

You've got TONS of repeat entries in there...

I'm counting the first entry (000info.com) 5 times...
Looks like the whole list is repeated that many times?

I'm not sure how you tried to merge them... or I'd fix it.

BTW: Thanks for all the work you put into this. Great idea!
March 16th, 2005, 05:03 PM
ikalo

Very interesting subject.
At this moment I don't have a need for this kind of setup, but I'll remeber it for future.

Tiger: I wanted to assign you some ponits for bringing this up, but before I could do that, I must "spread my antipoints"...
March 16th, 2005, 05:47 PM
dglosser

Quote:

You've got TONS of repeat entries in there...

Yikes! The bind file looks good, it looks like the program to create the boot file is foobar'ed. Thanks for pointing that out. I believe the problem is the file is not being reset when it is overwritten by the master template. It's being worked on as we speak. I think you can cut out the duplicates in one shot and just leave one set in... Or go to the "cvs" page and pick up an older copy. Well, this is a beta ;)

Quote:

Yeah but we dont care if our users cant get ads. You do have to be carefull because there are a couple AOL servers on the MVPS list and couple others that might affect valid traffic.

That was my main problem, as our users (and the users at many other corporations) need to see the ads. The MVPS list is now concentrating on malware sites, but there are many ad networks still listed.

Thanks for the feedback.
March 17th, 2005, 12:06 AM
dglosser

The file was fixed. It now contains "only" 3800 domains. Thanks.
March 17th, 2005, 12:08 AM
Tiger Shark

I have to congratulate you on an elegant solution....

I love it....
March 17th, 2005, 12:26 AM
phishphreek

The new file works great! Thanks. :)
March 17th, 2005, 02:59 AM
dglosser

Great news. If anyone has any pointers for using it in an AD domain, please let us know so we can update the how-to document. Thanks again.
March 17th, 2005, 03:02 AM
phishphreek

I had to forward my AD DNS servers to 2 member servers in which I just installed DNS without AD support.

So, my clients lookup to the AD DNS servers which forward to the stand alone servers which forward to my ISP's DNS servers.

Just in case one or both of my member servers (black hole servers) go down, the AD servers will forward to my ISP's DNS servers.

AFAIK, you can't use a boot file when using DNS in AD mode.

TS and I discussed that earlier in this thread... I beleive that configured the black hole dns on his public DNS servers and then forwarded his AD servers to his public DNS servers.
April 4th, 2005, 02:29 AM
dglosser

Just added the DNS Cache Poisoning domains (http://isc.sans.org/diary.php?date=2005-03-30).
List now contains over 4200 domains.