DNS RPZ Firewall Configuration Guide

Configuration Guide

?????

BIND is the world’s most used DNS server and can be configured as a DNS Firewall using RPZ files (DNS RPZ). Response Policy Zone (RPZ) enables DNS administrators to selectively block name resolution of Internet resources known to be used by cyber criminals.

Malware Patrol provides three zone files compatible with BIND 9 RPZ as one of our commercial feed options. They contain domains used to host C&Cs (command and control servers), domain names generated via DGAs (domain generation algorithms) used by malware and ransomware and domains hosting malware binaries. Its usage as a DNS firewall denies access to resources involved in malware and ransomware activities. DNS queries for these domains return a special address that advises users on why the access was blocked and prevents malware and ransomware infections, communications with C&Cs and drop zones commonly used to exfiltrate information. You can implement any or all zone files at your discretion. Follow these simple steps to configure your BIND 9 instance and protect the internal network, computers and users.

Please be advised that the usage of the malware RPZ zone may result in blocking large well known websites that are actively hosting malware and ransomware samples. The use of the DGAs and C&C zone files is less likely to deny access to renowned websites.

It is also worth noting that at this point Malware Patrol offers RPZ zone files for download AS WELL AS via access to our DNS servers for RPZ zone transfers.

1) Make sure your BIND 9 is installed and working properly. There are several resources on the Internet that can help you install it depending on your platform. If you are experiencing trouble, start at: https://www.isc.org/downloads/bind/. You should also be able to use distribution specific tools like apt-get and yum. For example: apt-get install bind9.
2) Determine the path to the configuration files used by BIND. This most likely will be /etc/bind or /etc/named. One way to find the path is to issue this command: find / -name named.conf
3) Notice: the path /etc/bind will be used throughout this How To, please adapt the commands shown here appropriately if your path is different.
4) Change to the directory that contains BIND configuration files, for example: cd /etc/bind
5) Set up cron jobs to regularly download the appropriate zone file(s) to the BIND configuration directory. URLs for the zone files can be found in your DNS RPZ data feeds portal. The DNS RPZ Firewall data feeds are updated every five minutes. You can use the MD5 hashes to validate the file’s integrity.
Add the following lines to named.conf.default-zones, according to the zones you want to use:
zone “mp_rpz_c2” {
type master;
file “/etc/bind/mp_rpz_c2.db”;
};
zone “mp_rpz_dga” {
type master;
file “/etc/bind/mp_rpz_dga.db”;
};
zone “mp_rpz_malware” {
type master;
file “/etc/bind/mp_rpz_malware.db”;
};
Add the following lines to named.conf.optionsunder the œoptions section, according to the zones you want to use:
response-policy {
zone “mp_rpz_c2”; zone “mp_rpz_dga”; zone “mp_rpz_malware”; };
Restart BIND with the following command: service bind9 restart

To make this set up effective, you should configure your customers’ DNS server(s) to point to this BIND instance. This can be easily achieved via DHCP. Still, customers may manually configure their systems to use external DNS servers, therefore bypassing this protection mechanism. To avoid that, apply firewall rules that properly deny traffic to external DNS servers.

This should be all you need to do. After that, browsers and applications that query your DNS server to resolve malicious domains will receive a safe response and won’t reach bad content.

If you experience any difficulties configuring BIND 9 to use Malware Patrol, please make sure it is working properly and contact our tech support at support (@) malwarepatrol.net.

?

Cisco ASA FirePOWER Configuration Guide

Configuration Guide

?

With Cisco ASA with FirePOWER Services, you consolidate multiple security layers in a single platform, eliminating the cost of buying and managing multiple solutions. This integrated approach combines best-in-class security technology with multilayer protection integrated in a single device that is less costly than piecemeal security solutions.

For more information, see Cisco’s product description: http://www.cisco.com/c/dam/en/us/products/collateral/security/asa-firepower-services/at-a-glance-c45-732426.pdf

Malware Patrol provides threat data compatible with Cisco ASA FirePOWER security intelligence feeds. There are three types of feeds that can be applied:

  1. IP addresses: includes IP addresses of malware C&Cs as well as those resolved from malware and ransomware DGAs.
  2. URLs: includes partial URLs used by malware and ransomware to contact command and control systems and drop zones.
  3. Domains: includes registered active domains generated via DGAs for malware and ransomware.

You can follow these simple steps to configure your Cisco ASA FirePOWER to filter malicious IPs and protect the internal network, computers and users from getting infected by malware. The same procedure can be followed to filter URLs and domains.

An image of the Cisco Firepower Login in the Cisco ASA Malware Patrol Configuration Guide

1) Log in to Cisco FirePOWER Management Center.

Cisco ASA Malware Patrol Configuration Guide Panel 1

2) Choose Objects > Object Management.

Cisco ASA Malware Patrol Configuration Guide Panel 2

3) Expand the Security Intelligence node, then choose Network Lists and Feeds.

Cisco ASA Malware Patrol Configuration Guide Panel 3

4) Click Add Network Lists and Feeds.
5) Enter a name for the feed (ex: MalwarePatrol_malicious_IPs).
6) Choose Feed from the Type drop-down list.
7) Enter the corresponding feed URL that can be found logging in to the Malware Patrol website.
8) Enter the corresponding feed MD5 URL that can be found logging in to the Malware Patrol website.
9) Choose the Update Frequency, we suggest one hour.
10) Choose Save.

Cisco ASA Malware Patrol Configuration Guide Panel 4

 

Cisco ASA Malware Patrol Configuration Guide Panel 5

11) Click Update Feeds.

Cisco ASA Malware Patrol Configuration Guide Panel 6

 

Cisco ASA Malware Patrol Configuration Guide Panel 7

12) Cisco ASA FirePOWER will automatically update the data feed at the chosen interval.

Cisco ASA Malware Patrol Configuration Guide Panel 8

13) Choose Policies / Access Control and click New Policy.

Cisco ASA Malware Patrol Configuration Guide Panel 9

14) Enter a meaningful Name and Description to the policy. The Default Action must be Block all traffic. On Available Devices select the devices that will be affected by the policy and click Add to Policy. When you are done, click Save.

Cisco ASA Malware Patrol Configuration Guide Panel 10

15) A new policy will be created. Click on Security Intelligence.

Cisco ASA Malware Patrol Configuration Guide Panel 11

16) On Available Objects / Networks select the object created previously (ex: MalwarePatrol_malicious_IPs), choose a zone from Available zones (Any is the default) and click on Add to Blacklist.

Cisco ASA Malware Patrol Configuration Guide Panel 12

17) The object and corresponding policy were created successfully. You can follow the same steps to use the other data feeds we provide.

Cisco ASA Malware Patrol Configuration Guide Panel 13

 

If you experience any difficulties configuring Cisco ASA FirePOWER to use Malware Patrol data feeds, please make sure it is working properly and contact our tech support at support (@) malwarepatrol.net.

?