Bots don’t sleep, ransomware finds new ways to infiltrate systems and yesterday’s defenses may be ineffective tomorrow. Cybersecurity requires vigilance. But vigilance alone won’t suffice. That’s why threat researchers and enterprise security analysts need effective tools to detect malware indicators and protect systems. Luckily, DNS sinkholes do both.

What’s a DNS Sinkhole?

In the Internet’s vast highway of connections, DNS sinkholes redirect network traffic. They intercept packets attempting to reach a certain address and reroute them. Consequently, both good and bad actors use sinkholes.

In cybersecurity, researchers use their power for good.

For example, remember the Wannacry ransomware attack? It affected more than 200,000 computers in 150 countries. Do you know what stopped its spread? A sinkhole. A security company deployed it. That sinkhole slowed the attack’s progress, giving businesses time to install a patch that inoculated their machines.

To be honest, they had a little help. Wannacry had a built-in fault that left it vulnerable. Its creators hardcoded a single static domain name into the malware. It was supposed to be a kill switch if they wanted to stop its spread. One problem: the static domain was left available for registration. So for less than $11 to register the domain and with the infrastructure and bandwidth to support a massive sinkhole, a cybersecurity researcher on vacation flipped the switch and funneled all that traffic into a waiting abyss.

It bought just enough time to get in front of the spread and contain the threat. Most DNS sinkholes operate a bit differently of course. Administrators design them to find a broad array of threats, not just one.

Using DNS sinkholing, threat researchers capture, monitor and analyze malicious Internet traffic in real time. Certainly one of the most obvious indicators of maliciousness is an attempt to connect to a known botnet command and control (C2) server. When users attempt to connect to an identified C2, a false, controlled IP address is returned and the traffic actually goes to a sinkhole, a server that an administrator controls.

Why Use a Sinkhole?

Once traffic goes to a sinkhole, threat researchers can tell which computers may be infected and notify users. Not only that – seeing how machines communicate with a malicious domain allows threat researchers to craft defenses that counter those tactics, techniques and procedures (TTP).

Then they can share the collected intelligence. This effectively neutralizes certain attack TTPs because over time the defense becomes an industry standard. After that, though every company may not adopt the defense straight away, they now have the ability to do so.

Companies differ, but often the strategies used to attack them don’t. It’s one advantage we’d do well to exploit.

For this reason, white hat sinkhole IP addresses are a useful tool for both reactive and proactive cybersecurity. With the valuable data contained in them, threat researchers can detect potential malware, protect their networks and contribute to the safety of the entire Internet.

How Can You Start Using DNS Sinkholes?

If you want to find DNS sinkholes, there are a few tested methods for identifying them. First, try reviewing the WHOIS nameservers information and SSL certificates. These are probably the two most straight-forward sources. Because of this, you’ll probably find more security companies sinkholing for research purposes.

On other side of the spectrum, you can find instructions for setting up a sinkhole with some basic research. Just make sure that you use a trusted source or software solution. Whichever method you choose, DNS sinkholes are an infosec tool worth acquiring to detect, protect, and anticipate the next threat.

By Tenea D. Johnson

Founder, Progress By Design

Malware Patrol’s CEO Andre Correa was recently interviewed by Dana Mantilia from Identity Protection Planning. They discussed the basics – and more – about ransomware:

• What is Ransomware?
• What should a company do in the case of an attack?
• Why is paying ransom a bad idea?
• Why has cryptocurrency became the main payment method for ransom?
• How do you recover from an attack?

This is a worthwhile watch if you have unanswered questions or want to review what you already know. In the event that your organization suffers (or has suffered) an attack, you will have some difficult decisions to make. The more you can prepare yourself and your team for how to respond, the better your recovery will be.

An attack impacts each organization differently, and now double extortion ransomware has complicated the simplistic “never pay” stance that many in the industry take. These considerations make it important to seek information from a variety of sources. You will need to find the solutions that fit your organization’s situation.

Not surprisingly, we want to emphasize the importance of using threat intelligence to help prevent and detect threats in your environment. Securing your organization is simply easier when you know what you are supposed to be blocking or hunting!

Malware Patrol offers three data feeds that specifically cover this threat: 1) URLs known to be hosting ransomware (or the malware that is used to open access to network for the ransomware install), 2) Command & Control Servers and 3) DGAs, the URLs/domains from which malware and ransomware receive their instructions and/or to which they send stolen data.

Everyone wants to know how to protect against ransomware – 2021 is the year of ransomware! The Colonial Pipeline attack shutdown a major oil distribution line and held it for ransom. Kaseya, a software vendor, was targeted with a $70 million ransom in bitcoin on July 5^th(1). Both of these incidents and others are still ongoing, but shouldn’t the real focus be on how to not become the next headline?

The cybersecurity industry is robust and varied with many elaborate platforms and tools that promise to protect against ransomware and everything else. Alluring technology, like machine learning and artificial intelligence, are touted to detect zero-days or other undetecables. Unfortunately, as well intentioned as these tools are, the peak effectiveness of a security program is not attainable without the implementation of some basic best practices. 

Seventy five percent of companies infected with ransomware were running up-to-date endpoint protection(2). This demonstrates that it can be the small innocuous things that result in an intrusion, such as outdated devices connected to the network (2), or human errors. It is these holes and similarly simplistic avenues that basic best practices or the most basic features of your cybersecurity defense system are designed to cover. “Basic” in many ways is a misnomer. These are truly the foundations on which an entire cybersecurity system depends. CISA, the United States Cybersecurity and Infrastructure Security Agency’s, guide to ransomware lists these best practices as(3):

• Update software and operating systems with the latest patches. Outdated applications and operating systems are the target of most attacks.
• Never click on links or open attachments in unsolicited emails.
• Back up data on a regular basis. Keep it on a separate device and store it offline.
• Follow safe practices when using devices that connect to the Internet:
• Improve password security(3):
• • • Create a strong password.
    • Consider using a password manager.
    • Use multi-factor authentication, if available.
    • Use security questions properly.
    • Create unique accounts for each user per device.

• • Choose secure networks.
  • Keep all of your personal electronic device software current.
  • Be suspicious of unexpected emails.

These guidelines should be implemented by both individuals and corporations. Proper foundational tactics can protect against ransomware and its most common vehicles of delivery, such as phishing. Phishing through texts, messaging, or emails is one of the more common avenues in which ransomware is delivered. As recommended by UC Berkley, if you don’t know the sender, then don’t click (6) and consider adding a few checks to ensure you know the sender for familiar contacts or organizations that hackers may hijack, such as Microsoft or one’s own employer(6).

The bulk of these practices are meant to aid prevention of intrusion, but one step is your insurance against loss if an incident happens: data backups. Ransomware is essentially a hostage situation and there is no guarantee that your data and system will be returned in the condition it was seized in. For organizations, it is critical to have backups when auditing and re-uploading their data once they have recovered from the ransom situation. However, if there is a secure backup, then there is no need to pay the ransom at all.

Once these foundational practices are in place, build upon them with some well-known defense tactics, and add a few less well known ones. These include making sure anti-malware software is always enabled, running real-time scanning(5), and restricting privileges within an organization or network(3). These settings and tools can prevent malware from running or at least limit its capacity to spread. Additional practices recommended by CISA are(3):

• Restrict users’ permissions to install and run software applications, and apply the principle of “least privilege” to all systems and services[…].
• Use application allow listing to allow only approved programs to run on a network.
• Enable strong spam filters to prevent phishing emails from reaching the end users and authenticate inbound email to prevent email spoofing.
• Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
• Configure firewalls to block access to known malicious IP addresses.

This second layer of best practices to protect against ransomware can be further strengthened with threat intelligence. Armed with a variety of reputable IoC sources, your security tools will be able to recognize traffic to/from as well as to block access to ransomware and its control infrastructure. For example, Malware Patrol offers a feed of malware & ransomware URLs. Additional feeds include DGAs and C2s, which are domains and URLs/addresses that, once accessed, allow the malware or ransomware to establish contact with its control infrastructure.   

A solid foundation in the basic best practices aids in the prevention of ransomware attacks for individuals and organizations. Cybersecurity is not just one singular thing, but is instead many layers that build and support each other. Ingrain these best practices until they’re a rote memory and utilize the tools that support and emphasize them in order to better support the rest of your cybersecurity system. Hacker attacks and ransomware threats aren’t going away, but by being diligent the undertow and its dangers are avoidable.

References

1. https://www.cnn.com/2021/07/06/tech/kaseya-ransomware-what-we-know/index.html
2. https://purplesec.us/cyber-security-trends-2021/#Ransomware
3. https://cisa.gov/ransomware
4. https://us-cert.cisa.gov/ncas/tips/ST04-003
5. https://security.berkeley.edu/resources/best-practices-how-to-articles/top-10-secure-computing-tips
6. https://www.techrepublic.com/article/new-phishing-attack-hijacks-email-conversations-how-companies-can-protect-employees/