How Does DNS Detect and Block Modern Attacks?

TL;DR

DNS-layer security can expose compromised systems, command-and-control callbacks, covert tunnels, and suspicious infrastructure by analyzing queries at recursive resolvers. Effective defense requires examining both user-side and authoritative-side data, detecting unusual encodings and domain behavior, and applying filtering above the basic network layer when legitimate DNS servers proxy communications with attacker-controlled infrastructure.

Transcript

Uh, hello and welcome everyone. I really appreciate you guys coming. I know the last day usually the hardest one. You already had, like, three nights of networking parties and content, so really appreciate you all being here. So today, uh, what we will talk about, uh, examples of some of the notable attacks within last few years, how DNS was involv... Read More

Key Insights

• Recursive DNS resolvers are strategic observation points because they collect downstream queries from users and upstream information associated with authoritative DNS systems. Combining these perspectives supports detection of compromised systems, command-and-control callbacks, related domains, suspicious infrastructure, and abusive hosting environments.
• Downstream DNS data is useful for identifying activity tied to individual systems and user behavior. Query patterns can reveal compromised machines, callbacks to command-and-control services, domain co-occurrence, and relationships among domains that might not appear suspicious when each request is examined separately.
• Upstream DNS data is useful for discovering infrastructure before it becomes overtly malicious. Defenders can identify domains and hosting environments that share features with known indicators, place them under observation, and respond if later behavior confirms that the infrastructure has become hostile.
• DNS tunneling is a covert communication method that encodes data within DNS traffic. Attackers may place information in subdomains or record contents, divide it into chunks, and alter encoding or payload length to evade controls that recognize only fixed tunneling patterns.
• Adaptive attackers are difficult to stop with narrow DNS signatures because they can learn which encodings, record types, and query lengths trigger detection. They can then modify outgoing data, shorten subdomains, switch record usage, or change chunk sizes while preserving the covert communication channel.
• SolarWinds demonstrated that DNS can support several stages of a sophisticated compromise. The SunBurst backdoor used DNS to communicate information about affected organizations, while subsequent command-and-control activity enabled additional malware, including Cobalt Strike and Teardrop, to be installed.
• Winnti's tunneling implementation is based on a heavily modified off-the-shelf component. It uses encoded data appended to fully qualified domain names, separates content to respect hostname restrictions, and exposes configurable functions that let operators change encoding schemes, payload lengths, and data segmentation.
• Legitimate DNS infrastructure can obscure the endpoint of malicious communication because a normal resolver may proxy requests between an infected host and an attacker-controlled name server. Defenders examining only the nearest network connection may therefore miss the true destination and need higher-layer DNS analysis and filtering.

Questions & Answers

Q: How can DNS data help detect modern cyberattacks?

DNS data can reveal compromised systems, command-and-control callbacks, covert tunnels, suspicious domain relationships, and infrastructure being prepared for later attacks. A recursive resolver is especially useful because it observes requests arriving from users and information obtained from authoritative DNS systems. Correlating these perspectives gives defenders behavioral context that isolated network connections or individual domain indicators may not provide.

Q: Why is a recursive DNS resolver valuable for security monitoring?

A recursive DNS resolver sits between users and authoritative DNS infrastructure, giving it access to complementary data. On the downstream side, it sees user queries that can expose infected devices and unusual behavior. On the upstream side, it can reveal newly staged domains, related infrastructure, and hosting environments associated with abuse. This position supports both active-threat detection and earlier monitoring.

Q: What is DNS tunneling and how does it work?

DNS tunneling uses DNS requests and responses as a covert channel for commands or data. Malware generates hostnames that contain encoded information and sends queries through normal DNS infrastructure toward an attacker-controlled name server. The attacker can read the embedded content and return instructions. Because legitimate resolvers may proxy this traffic, the communication can resemble ordinary DNS activity at the network level.

Q: How do attackers evade DNS tunneling detection?

Attackers can adapt the tunnel after observing what an organization's controls detect. They may switch encoding schemes, place data in different parts of a DNS request, shorten long subdomains, change request types, or divide payloads into differently sized chunks. This flexibility allows the same communication purpose to continue even when defenders deploy rules against a specific record type, format, or query length.

Q: How was DNS involved in the SolarWinds attack?

The SolarWinds compromise involved a trojanized software component and the SunBurst backdoor. DNS served as a covert channel for communicating information about compromised organizations. It was also connected to command-and-control activity that supported the installation of additional malware, including Cobalt Strike and Teardrop. The use of dynamically generated domains made protection based on a single hard-coded destination less effective.

Q: How did Winnti use DNS tunneling in its campaigns?

Winnti used a heavily modified version of an off-the-shelf DNS tunneling component. Its implementation encoded data and appended it to fully qualified domain names, inserted separators to remain compatible with hostname restrictions, and ran an embedded component in memory. Operators could adjust encoding, payload length, and chunking, helping the tunnel evade security products that expected standard tool behavior.

Q: Why are DNS record types useful for covert communication?

Some DNS record types were designed to carry relatively flexible data, which makes them attractive for tunneling. The transcript describes attackers using null and TXT requests for communication and exfiltration because many organizations or security products do not closely inspect their contents. However, attackers can also move encoded material into subdomains, so monitoring only particular record types leaves important coverage gaps.

Q: What DNS defenses can reduce command-and-control and data exfiltration risks?

Defenders should collect and analyze DNS data at recursive resolvers, correlate downstream user activity with upstream infrastructure observations, and look for behavioral signs rather than relying on one fixed signature. Useful signals include suspicious encodings, unusual subdomains, changing payload lengths, related domain activity, and connections to abusive infrastructure. Filtering may need to operate above the basic network layer when legitimate resolvers proxy malicious traffic.

Summary & Key Takeaways

• Recursive DNS resolvers provide a valuable security vantage point because they observe queries from users and responses or infrastructure information from authoritative DNS systems. These combined data sets can reveal compromised devices, command-and-control callbacks, related domain behavior, newly staged infrastructure, and hosting providers that ignore abuse complaints or malicious activity.

• DNS tunneling turns ordinary DNS traffic into a covert channel by encoding commands or stolen information within subdomains and record contents. Attackers can change encoding schemes, payload lengths, chunk sizes, and request types after learning what defensive controls detect, making rigid signatures and inspection limited to obvious query patterns insufficient.

• Major intrusions demonstrate that DNS can support victim identification, command delivery, malware installation, and data exfiltration. SolarWinds used DNS as a covert channel, while groups including OilRig and Winnti adopted tunneling techniques. Defenders should analyze resolver data broadly, monitor suspicious infrastructure, and inspect higher-level DNS behavior for adaptive abuse.