Educator: IP and DNS Analysis. 2 2
Now, many intrusions rely on C2 servers 3 3
or command and control servers 4 4
for the attack to download additional attack tools 5 5
and exfiltrate data. 6 6
Therefore, one of the particular areas of interest 7 7
to a cybersecurity analyst is to analyze traffic 8 8
for any access request to an external host. 9 9
If you can identify these, 10 10
usually you're going to be relying 11 11
on the analysis of an IP address and their DNS resolutions. 12 12
If you subscribe to a service 13 13
that provides reputation-based feeds, 14 14
most of these are going to be based on IP and DNS as well. 15 15
Now, in the old days, 16 16
malware used to be configured to contact 17 17
a specific static IP or DNS name as part of its code. 18 18
So when that malware was downloaded and installed, 19 19
it would call out to a specific static IP or DNS name. 20 20
Now, because of that, 21 21
we would be able to develop what we call 22 22
a known-bad IP address. 23 23
These known-bad IP addresses are an IP address 24 24
or range of IP addresses 25 25
that appears on one or more of our block lists, 26 26
and these block lists were a way 27 27
that we could basically play whack-a-mole. 28 28
A bad guy would start a new domain, 29 29
we would find out it was bad, 30 30
we would put it on the block list. 31 31
They would start another domain, 32 32
and we'd keep doing this over and over. 33 33
This is how reputation-based risk intelligence is done 34 34
to create an IP or URL block list. 35 35
We find something bad, we add it to the list. 36 36
And so here you can see 37 37
on my block list is a thing called bol.com.br, 38 38
and you'll notice that it's listed as a RAT 39 39
because it is a Remote Access Trojan 40 40
that's been associated with this particular DNS. 41 41
Now, that's great, and that means that we can block this 42 42
but if they change their domain name, 43 43
we're now going to have to go find that and block that too. 44 44
As defenders, we try to outsmart the bad guys, 45 45
but every time we find a way to block them, 46 46
they find another way to get around it. 47 47
And because we started using a lot of block lists 48 48
and blocking known-bad IPs and known-bad DNS, 49 49
they started using what's known as 50 50
domain generation algorithms to overcome those block lists. 51 51
Now, what is a domain generation algorithm? 52 52
Well, a domain generation algorithm or DGA 53 53
is a method used by malware to evade block lists 54 54
by generating domain names 55 55
for command and control networks dynamically. 56 56
Instead of having a static IP or a static name, 57 57
they can create ones and pick from a list of a lot of them, 58 58
and then keep moving through those until we block them all, 59 59
and then they'll just create more. 60 60
And they keep doing this over and over dynamically. 61 61
Let's talk about how this works. 62 62
There are five steps for an attacker to use. 63 63
Now, the first thing an attacker is going to do 64 64
is they're going to set up one or more dynamic DNS services. 65 65
This allows them to be able to have domain names 66 66
that can be automatically generated on the fly. 67 67
When they do this, they'll sign up with a service 68 68
using fake payment or fake credentials, 69 69
or they might use some host that really doesn't care 70 70
if they're doing illicit activity. 71 71
Once they do that, they'll move into step two, 72 72
and this is where the malware code 73 73
is going to implement the DGA. 74 74
This DGA is then used to create a list of new domain names. 75 75
Now, the way this works is it's an algorithm, 76 76
and it will use some kind of value to seed it 77 77
and then that algorithm, everybody who has it, 78 78
knows what that initial seed is 79 79
has the same key essentially 80 80
to be able to use the same list. 81 81
So if the piece of malware has it and their server has it, 82 82
they both will have the same dynamically allocated names 83 83
that they can jump to each time. 84 84
The way this works is essentially like an algorithm 85 85
that uses some kind of a seed or a random number 86 86
or a time-based or something like that. 87 87
So, for instance, 88 88
we might have a start date that we're going to use 89 89
and that is going to be the seed. 90 90
As we use that, 91 91
it's going to create an output of a bunch of cryptic strings 92 92
that basically have numbers and letters 93 93
to make up domain names. 94 94
This way, they're all randomized, 95 95
and they won't already be part of your block list. 96 96
Then they move into their third step. 97 97
At this point, a parallel DGA is going to be used 98 98
to create the name records in the DDNS service. 99 99
So now that we know what the malware is going to use, 100 100
we also need the DDNS service to have it 101 101
so those two can match up, 102 102
and again, if they both use the same seed, 103 103
they're going to have the same matching names. 104 104
Then we go into step four. 105 105
This is where the malware tries a selection 106 106
of those domains that it created 107 107
to connect to the C2 server. 108 108
This is in case the seed was off by a little bit, 109 109
hopefully they'll still match up, 110 110
and they'll be able to make that connection. 111 111
And then, number five. 112 112
The C2 server is going to communicate a new seed over time 113 113
so that way they can change that DGA 114 114
in case you reverse engineered it 115 115
and tried to block their attempts. 116 116
This way, they can prevent themselves from being blocked 117 117
and continue to do bad stuff. 118 118
That's the idea with this DGA. 119 119
It's this dynamic list that is constantly changing. 120 120
Now, because it has this constantly changing architecture, 121 121
this is often known as a fast flux network. 122 122
Now, a fast flux network is a method used by malware 123 123
to hide the presence of C2 networks 124 124
by continually changing the host IP addresses 125 125
in the domain records using domain generated algorithms. 126 126
Essentially, everything we just talked about with DGA, 127 127
that is part of a fast flux network. 128 128
So, you may be wondering, 129 129
"As analysts, what can we do to detect a DGA?" 130 130
Well, there's a couple of giveaways 131 131
that you're dealing with a DGA or a fast flux network. 132 132
Now, the first one that you'll see 133 133
is if you start seeing a lot of call outs from your systems 134 134
to random IP addresses that look something like this. 135 135
For instance, you see this random series 136 136
of letters and numbers.com. 137 137
That is a great sign that you are dealing 138 138
with some sort of computer generated labels 139 139
with some kind of constant to value ratio 140 140
that just doesn't look right. 141 141
Most people wouldn't buy a domain name 142 142
like A1ZWBR93.com. 143 143
They would buy diontraining.com 144 144
or comptia.org or something like that. 145 145
So if you see things like this, 146 146
it's usually a sign 147 147
that there's something malicious going on. 148 148
The second thing that you can do to detect a DGA 149 149
is if you start seeing a high rate of NXDOMAIN errors 150 150
when you're resolving to DNS in your logs, 151 151
this could be an indicator of a DGA. 152 152
Now, what is an NXDOMAIN error? 153 153
Well, have you ever gone to a website and you got a message 154 154
that looks like this? 155 155
It says, "This site cannot be reached. 156 156
DNS probe finished NXDOMAIN." 157 157
That's an NXDOMAIN error. 158 158
Essentially, you've tried looking up that domain name 159 159
and you can't figure it out. 160 160
That's what it is. 161 161
That's when you can't get the DNS resolver 162 162
to resolve that DNS for you. 163 163
And if you're using something like a dynamic DNS 164 164
like this with a fast flux network, 165 165
often they're already moved off of that domain 166 166
and onto another one 167 167
and so you're going to get an NXDOMAIN error. 168 168
Now, how do you mitigate these DGAs? 169 169
Well, the best mitigation is to use 170 170
a secure recursive DNS resolver. 171 171
This is going to allow one trusted DNS server 172 172
to communicate with several other trusted DNS servers 173 173
to hunt down the IP address and return it to the client. 174 174
So instead of going out to a generic DNS service 175 175
to be able to get those domain names to IP resolutions, 176 176
you should be using a trusted DNS server 177 177
that uses recursive lookup. 178 178
If you do that, 179 179
and they maintain a knowledge 180 180
of what type of DGAs are out there, 181 181
they will constantly blocking those for you 182 182
and help protect your network.