1 1 00:00:00,347 --> 00:00:02,891 IP and DNS Analysis. 2 2 00:00:02,891 --> 00:00:05,606 Now, many intrusions rely on C2 servers 3 3 00:00:05,606 --> 00:00:07,380 or command and control servers 4 4 00:00:07,380 --> 00:00:10,110 for the attack to download additional attack tools 5 5 00:00:10,110 --> 00:00:11,659 and exfiltrate data. 6 6 00:00:11,659 --> 00:00:14,264 Therefore, one of the particular areas of interest 7 7 00:00:14,264 --> 00:00:16,996 to a cybersecurity analyst is to analyze traffic 8 8 00:00:16,996 --> 00:00:20,207 for any access request to an external host. 9 9 00:00:20,207 --> 00:00:21,716 If you can identify these, 10 10 00:00:21,716 --> 00:00:23,280 usually you're going to be relying 11 11 00:00:23,280 --> 00:00:27,120 on the analysis of an IP address and their DNS resolutions. 12 12 00:00:27,120 --> 00:00:28,111 If you subscribe to a service 13 13 00:00:28,111 --> 00:00:30,005 that provides reputation-based feeds, 14 14 00:00:30,005 --> 00:00:33,519 most of these are going to be based on IP and DNS as well. 15 15 00:00:33,519 --> 00:00:34,682 Now, in the old days, 16 16 00:00:34,682 --> 00:00:36,772 malware used to be configured to contact 17 17 00:00:36,772 --> 00:00:41,161 a specific static IP or DNS name as part of its code. 18 18 00:00:41,161 --> 00:00:43,331 So when that malware was downloaded and installed, 19 19 00:00:43,331 --> 00:00:47,331 it would call out to a specific static IP or DNS name. 20 20 00:00:47,331 --> 00:00:48,720 Now, because of that, 21 21 00:00:48,720 --> 00:00:50,340 we would be able to develop what we call 22 22 00:00:50,340 --> 00:00:52,091 a known-bad IP address. 23 23 00:00:52,091 --> 00:00:54,752 These known-bad IP addresses are an IP address 24 24 00:00:54,752 --> 00:00:56,296 or range of IP addresses 25 25 00:00:56,296 --> 00:00:59,070 that appears on one or more of our block lists, 26 26 00:00:59,070 --> 00:01:00,390 and these block lists were a way 27 27 00:01:00,390 --> 00:01:02,130 that we could basically play whack-a-mole. 28 28 00:01:02,130 --> 00:01:03,482 A bad guy would start a new domain, 29 29 00:01:03,482 --> 00:01:04,985 we would find out it was bad, 30 30 00:01:04,985 --> 00:01:06,450 we would put it on the block list. 31 31 00:01:06,450 --> 00:01:07,800 They would start another domain, 32 32 00:01:07,800 --> 00:01:09,540 and we'd keep doing this over and over. 33 33 00:01:09,540 --> 00:01:12,209 This is how reputation-based risk intelligence is done 34 34 00:01:12,209 --> 00:01:15,210 to create an IP or URL block list. 35 35 00:01:15,210 --> 00:01:17,281 We find something bad, we add it to the list. 36 36 00:01:17,281 --> 00:01:18,254 And so here you can see 37 37 00:01:18,254 --> 00:01:21,984 on my block list is a thing called bol.com.br, 38 38 00:01:21,984 --> 00:01:24,671 and you'll notice that it's listed as a RAT 39 39 00:01:24,671 --> 00:01:26,258 because it is a Remote Access Trojan 40 40 00:01:26,258 --> 00:01:29,006 that's been associated with this particular DNS. 41 41 00:01:29,006 --> 00:01:31,387 Now, that's great, and that means that we can block this 42 42 00:01:31,387 --> 00:01:33,028 but if they change their domain name, 43 43 00:01:33,028 --> 00:01:36,060 we're now going to have to go find that and block that too. 44 44 00:01:36,060 --> 00:01:38,364 As defenders, we try to outsmart the bad guys, 45 45 00:01:38,364 --> 00:01:40,680 but every time we find a way to block them, 46 46 00:01:40,680 --> 00:01:42,810 they find another way to get around it. 47 47 00:01:42,810 --> 00:01:44,295 And because we started using a lot of block lists 48 48 00:01:44,295 --> 00:01:47,615 and blocking known-bad IPs and known-bad DNS, 49 49 00:01:47,615 --> 00:01:49,379 they started using what's known as 50 50 00:01:49,379 --> 00:01:53,340 domain generation algorithms to overcome those block lists. 51 51 00:01:53,340 --> 00:01:55,559 Now, what is a domain generation algorithm? 52 52 00:01:55,559 --> 00:01:58,401 Well, a domain generation algorithm or DGA 53 53 00:01:58,401 --> 00:02:01,074 is a method used by malware to evade block lists 54 54 00:02:01,074 --> 00:02:02,594 by generating domain names 55 55 00:02:02,594 --> 00:02:05,200 for command and control networks dynamically. 56 56 00:02:05,200 --> 00:02:07,858 Instead of having a static IP or a static name, 57 57 00:02:07,858 --> 00:02:10,503 they can create ones and pick from a list of a lot of them, 58 58 00:02:10,503 --> 00:02:13,369 and then keep moving through those until we block them all, 59 59 00:02:13,369 --> 00:02:14,738 and then they'll just create more. 60 60 00:02:14,738 --> 00:02:17,730 And they keep doing this over and over dynamically. 61 61 00:02:17,730 --> 00:02:19,440 Let's talk about how this works. 62 62 00:02:19,440 --> 00:02:21,523 There are five steps for an attacker to use. 63 63 00:02:21,523 --> 00:02:23,302 Now, the first thing an attacker is going to do 64 64 00:02:23,302 --> 00:02:27,228 is they're going to set up one or more dynamic DNS services. 65 65 00:02:27,228 --> 00:02:29,820 This allows them to be able to have domain names 66 66 00:02:29,820 --> 00:02:32,370 that can be automatically generated on the fly. 67 67 00:02:32,370 --> 00:02:33,661 When they do this, they'll sign up with a service 68 68 00:02:33,661 --> 00:02:35,830 using fake payment or fake credentials, 69 69 00:02:35,830 --> 00:02:37,999 or they might use some host that really doesn't care 70 70 00:02:37,999 --> 00:02:39,862 if they're doing illicit activity. 71 71 00:02:39,862 --> 00:02:42,360 Once they do that, they'll move into step two, 72 72 00:02:42,360 --> 00:02:43,337 and this is where the malware code 73 73 00:02:43,337 --> 00:02:45,690 is going to implement the DGA. 74 74 00:02:45,690 --> 00:02:48,564 This DGA is then used to create a list of new domain names. 75 75 00:02:48,564 --> 00:02:50,470 Now, the way this works is it's an algorithm, 76 76 00:02:50,470 --> 00:02:52,814 and it will use some kind of value to seed it 77 77 00:02:52,814 --> 00:02:55,065 and then that algorithm, everybody who has it, 78 78 00:02:55,065 --> 00:02:56,364 knows what that initial seed is 79 79 00:02:56,364 --> 00:02:57,665 has the same key essentially 80 80 00:02:57,665 --> 00:02:59,790 to be able to use the same list. 81 81 00:02:59,790 --> 00:03:02,009 So if the piece of malware has it and their server has it, 82 82 00:03:02,009 --> 00:03:04,652 they both will have the same dynamically allocated names 83 83 00:03:04,652 --> 00:03:06,773 that they can jump to each time. 84 84 00:03:06,773 --> 00:03:09,234 The way this works is essentially like an algorithm 85 85 00:03:09,234 --> 00:03:11,324 that uses some kind of a seed or a random number 86 86 00:03:11,324 --> 00:03:13,503 or a time-based or something like that. 87 87 00:03:13,503 --> 00:03:14,490 So, for instance, 88 88 00:03:14,490 --> 00:03:16,440 we might have a start date that we're going to use 89 89 00:03:16,440 --> 00:03:17,687 and that is going to be the seed. 90 90 00:03:17,687 --> 00:03:18,840 As we use that, 91 91 00:03:18,840 --> 00:03:21,374 it's going to create an output of a bunch of cryptic strings 92 92 00:03:21,374 --> 00:03:23,044 that basically have numbers and letters 93 93 00:03:23,044 --> 00:03:25,170 to make up domain names. 94 94 00:03:25,170 --> 00:03:26,594 This way, they're all randomized, 95 95 00:03:26,594 --> 00:03:28,680 and they won't already be part of your block list. 96 96 00:03:28,680 --> 00:03:30,420 Then they move into their third step. 97 97 00:03:30,420 --> 00:03:32,477 At this point, a parallel DGA is going to be used 98 98 00:03:32,477 --> 00:03:35,607 to create the name records in the DDNS service. 99 99 00:03:35,607 --> 00:03:37,980 So now that we know what the malware is going to use, 100 100 00:03:37,980 --> 00:03:39,551 we also need the DDNS service to have it 101 101 00:03:39,551 --> 00:03:41,190 so those two can match up, 102 102 00:03:41,190 --> 00:03:42,662 and again, if they both use the same seed, 103 103 00:03:42,662 --> 00:03:45,210 they're going to have the same matching names. 104 104 00:03:45,210 --> 00:03:46,330 Then we go into step four. 105 105 00:03:46,330 --> 00:03:48,214 This is where the malware tries a selection 106 106 00:03:48,214 --> 00:03:49,614 of those domains that it created 107 107 00:03:49,614 --> 00:03:51,497 to connect to the C2 server. 108 108 00:03:51,497 --> 00:03:53,850 This is in case the seed was off by a little bit, 109 109 00:03:53,850 --> 00:03:55,290 hopefully they'll still match up, 110 110 00:03:55,290 --> 00:03:57,090 and they'll be able to make that connection. 111 111 00:03:57,090 --> 00:03:58,560 And then, number five. 112 112 00:03:58,560 --> 00:04:01,133 The C2 server is going to communicate a new seed over time 113 113 00:04:01,133 --> 00:04:03,313 so that way they can change that DGA 114 114 00:04:03,313 --> 00:04:04,868 in case you reverse engineered it 115 115 00:04:04,868 --> 00:04:06,564 and tried to block their attempts. 116 116 00:04:06,564 --> 00:04:08,692 This way, they can prevent themselves from being blocked 117 117 00:04:08,692 --> 00:04:10,758 and continue to do bad stuff. 118 118 00:04:10,758 --> 00:04:12,900 That's the idea with this DGA. 119 119 00:04:12,900 --> 00:04:15,780 It's this dynamic list that is constantly changing. 120 120 00:04:15,780 --> 00:04:18,265 Now, because it has this constantly changing architecture, 121 121 00:04:18,265 --> 00:04:21,840 this is often known as a fast flux network. 122 122 00:04:21,840 --> 00:04:24,147 Now, a fast flux network is a method used by malware 123 123 00:04:24,147 --> 00:04:26,262 to hide the presence of C2 networks 124 124 00:04:26,262 --> 00:04:28,702 by continually changing the host IP addresses 125 125 00:04:28,702 --> 00:04:32,790 in the domain records using domain generated algorithms. 126 126 00:04:32,790 --> 00:04:35,268 Essentially, everything we just talked about with DGA, 127 127 00:04:35,268 --> 00:04:38,130 that is part of a fast flux network. 128 128 00:04:38,130 --> 00:04:39,367 So, you may be wondering, 129 129 00:04:39,367 --> 00:04:42,604 "As analysts, what can we do to detect a DGA?" 130 130 00:04:42,604 --> 00:04:43,926 Well, there's a couple of giveaways 131 131 00:04:43,926 --> 00:04:47,177 that you're dealing with a DGA or a fast flux network. 132 132 00:04:47,177 --> 00:04:48,649 Now, the first one that you'll see 133 133 00:04:48,649 --> 00:04:51,507 is if you start seeing a lot of call outs from your systems 134 134 00:04:51,507 --> 00:04:55,020 to random IP addresses that look something like this. 135 135 00:04:55,020 --> 00:04:56,311 For instance, you see this random series 136 136 00:04:56,311 --> 00:04:58,935 of letters and numbers.com. 137 137 00:04:58,935 --> 00:05:00,976 That is a great sign that you are dealing 138 138 00:05:00,976 --> 00:05:03,096 with some sort of computer generated labels 139 139 00:05:03,096 --> 00:05:05,215 with some kind of constant to value ratio 140 140 00:05:05,215 --> 00:05:06,892 that just doesn't look right. 141 141 00:05:06,892 --> 00:05:08,730 Most people wouldn't buy a domain name 142 142 00:05:08,730 --> 00:05:11,610 like A1ZWBR93.com. 143 143 00:05:11,610 --> 00:05:13,462 They would buy diontraining.com 144 144 00:05:13,462 --> 00:05:16,024 or comptia.org or something like that. 145 145 00:05:16,024 --> 00:05:17,610 So if you see things like this, 146 146 00:05:17,610 --> 00:05:18,443 it's usually a sign 147 147 00:05:18,443 --> 00:05:20,220 that there's something malicious going on. 148 148 00:05:20,220 --> 00:05:22,243 The second thing that you can do to detect a DGA 149 149 00:05:22,243 --> 00:05:25,019 is if you start seeing a high rate of NXDOMAIN errors 150 150 00:05:25,019 --> 00:05:27,274 when you're resolving to DNS in your logs, 151 151 00:05:27,274 --> 00:05:30,000 this could be an indicator of a DGA. 152 152 00:05:30,000 --> 00:05:32,059 Now, what is an NXDOMAIN error? 153 153 00:05:32,059 --> 00:05:34,083 Well, have you ever gone to a website and you got a message 154 154 00:05:34,083 --> 00:05:35,640 that looks like this? 155 155 00:05:35,640 --> 00:05:36,987 It says, "This site cannot be reached. 156 156 00:05:36,987 --> 00:05:39,433 DNS probe finished NXDOMAIN." 157 157 00:05:39,433 --> 00:05:41,280 That's an NXDOMAIN error. 158 158 00:05:41,280 --> 00:05:43,664 Essentially, you've tried looking up that domain name 159 159 00:05:43,664 --> 00:05:45,570 and you can't figure it out. 160 160 00:05:45,570 --> 00:05:46,403 That's what it is. 161 161 00:05:46,403 --> 00:05:48,000 That's when you can't get the DNS resolver 162 162 00:05:48,000 --> 00:05:49,577 to resolve that DNS for you. 163 163 00:05:49,577 --> 00:05:52,140 And if you're using something like a dynamic DNS 164 164 00:05:52,140 --> 00:05:53,632 like this with a fast flux network, 165 165 00:05:53,632 --> 00:05:55,683 often they're already moved off of that domain 166 166 00:05:55,683 --> 00:05:57,210 and onto another one 167 167 00:05:57,210 --> 00:05:59,460 and so you're going to get an NXDOMAIN error. 168 168 00:05:59,460 --> 00:06:01,666 Now, how do you mitigate these DGAs? 169 169 00:06:01,666 --> 00:06:03,433 Well, the best mitigation is to use 170 170 00:06:03,433 --> 00:06:05,946 a secure recursive DNS resolver. 171 171 00:06:05,946 --> 00:06:08,557 This is going to allow one trusted DNS server 172 172 00:06:08,557 --> 00:06:11,257 to communicate with several other trusted DNS servers 173 173 00:06:11,257 --> 00:06:14,340 to hunt down the IP address and return it to the client. 174 174 00:06:14,340 --> 00:06:16,464 So instead of going out to a generic DNS service 175 175 00:06:16,464 --> 00:06:19,100 to be able to get those domain names to IP resolutions, 176 176 00:06:19,100 --> 00:06:21,235 you should be using a trusted DNS server 177 177 00:06:21,235 --> 00:06:23,250 that uses recursive lookup. 178 178 00:06:23,250 --> 00:06:24,090 If you do that, 179 179 00:06:24,090 --> 00:06:25,116 and they maintain a knowledge 180 180 00:06:25,116 --> 00:06:27,006 of what type of DGAs are out there, 181 181 00:06:27,006 --> 00:06:28,901 they will constantly blocking those for you 182 182 00:06:28,901 --> 00:06:30,453 and help protect your network.