Detecting Queries to "odd" DNS Servers
Usually, your operating system will be assigned a DNS server either via DHCP (or RAs in IPv6) or statically. The resolver library on a typical workstation will then go forward and pass all DNS lookups to this set of DNS servers. However, malware sometimes tries to use its own DNS servers, and blocking outbound port 53 traffic (udp and tcp) can help identify these hosts.
Brent, one of our readers, does just that and keeps finding infected machines that way. Just now, he is investigating a system that attempted to connect to the following name servers:
101.226.4.6
114.114.114.114
114.114.115.115
123.125.81.6
140.207.198.6
202.97.224.69
211.98.2.4
218.30.118.6
14.33.133.189
He has not identified the malware behind this yet, but no other system he is using ("we are running bluecoat web filter AND we're using OpenDNS AND I'm running snort"). Brent uses oak (http://ktools.org/oak/) to help him watch his logs and alert him of issues like this.
According to the Farsight Security passive DNS database, these IPs resolve to a number of "interesting" hostnames. I am just showing a few here (the full list is too long)
ns-facebook-[number]-[number].irl-dns.info <- the [number] part appears to be a random number
*.v9dns.com <- '*' to indicate various host names in this domain.
v2.3322pay.com
bjcgsm.com
sf5100.com
------------------
Johannes B. Ullrich, Ph.D.
Network Monitoring and Threat Detection In-Depth | Singapore | Nov 18th - Nov 23rd 2024 |
Comments
C:\Users\me>nslookup
Default Server: google-public-dns-a.google.com
Address: 8.8.8.8
> server 101.226.4.6
Default Server: [101.226.4.6]
Address: 101.226.4.6
> facebook.com
Server: [101.226.4.6]
Address: 101.226.4.6
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Non-authoritative answer:
Name: facebook.com
Addresses: 59.24.3.173
59.24.3.173
Anonymous
May 21st 2014
1 decade ago
Anonymous
May 21st 2014
1 decade ago
Anonymous
May 21st 2014
1 decade ago
Yup! When I first set up the log-watching rules, I didn't have any snort sensors or any span ports yet. But one of these days real soon now, I'll turn this into a custom snort rule so I can see full packet payloads...
Anonymous
May 21st 2014
1 decade ago
Anonymous
May 23rd 2014
1 decade ago