Threat Analtics Data Exfiltration by DNS lookup TELE3119: Materials from Martin Lee of TALOS is gratefully acknowledged

Cyber Kill Chain Get Inside Find some data Exfiltrate it Trusted Networks

Email attack: malware distributing ransomware Getting Inside Email attack: malware distributing ransomware Trusted Networks

Exfiltrating Data ftp port 21 stolen data ssh port 22 http port 80 compromised system malicious.com Trusted Networks

Exfiltrating Data Block with FW rules or IP / domain block-list ftp port 21 stolen data ssh port 22 http port 80 compromised system malicious.com Block with FW rules or  IP / domain block-list  Trusted Networks

Exfiltrating Data Hypothetically speaking … Could we exfiltrate and evade:  IP blacklists  Firewall rules  Trusted Networks

DNS requests name server example.com local DNS server .com DNS server what is the address for www.example.com it is: 123.45.67.89 “Dunno, I’ll ask someone else” “Dunno, but I know some who does” “I know the answer” Trusted Networks

Exfiltrating Data by DNS name server malicious.com local DNS server reply: 192.168.0.1 DNS lookup for top.secret.data.malicious.com “top.secret.data” compromised system Trusted Networks

Exfiltrating Data by DNS DNS lookup problems:  Punctuation forbidden (limited to a-z & 0-9, no space or !) Case insensitive  Base64 Encoding ??   Base32 Encoding “top secret data”  ORXXAIDTMVRXEZLUEBSGC5DB  “Top Secret !!!!”  KRXXAICTMVRXEZLUEAQSCIJB  DNS requests logs  www.domain1.com  mail.domain2.com  server.xyz.domain3.com  ORXXAIDTMVRXEZLUEBSGC5DB.malicious.com    long random string! Trusted Networks

Let’s go hunting! Lets look for ‘long’ domain names. OpenDNS DNS Lookup Data  Lets look for ‘long’ domain names.  Oh, great there are 100 million! difficult to analyze data  need a model?  Trusted Networks

Model data: distribution frequency spike ??? the longer the length, the less frequent it becomes. closely follows an exponential decay curve. We know how to fit a curve to the data, how does exponential curve work. We construct a model for our expectation of a subdomain length. Subdomain length Trusted Networks

Identify Anomalies we only analyse particular length Subdomain length Trusted Networks

Active Exfiltration Pattern ? Stealing credit card data ! log.nu6timjqgq4dimbuhe.3ikfsb---redacted---cg3.7s3bnxqmavqy7sec.dojfgj.com lll.nu6toobygq3dsnjrgm.snksjg---redacted---dth.ejitjtk4g4lwvbos.amouc.com ooo.nu6tgnzvgm2tmmbzgq4a.rkgo---redacted---tw5.5z5i6fjnugmxfowy.beevish.com Pattern ? begins with 3 characters (i.e. log, lll, ooo), followed by a dot, followed by a long random string with a fingerprint (i.e. starts with nut6), followed by a dot, followed by a really long string, … Stealing credit card data ! Trusted Networks

Point of Sale malware would sniff the memory of PoS device to collect card numbers, Expiry date, etc Trusted Networks

Active Exfiltration PoS malware domain log.nu6timjqgq4dimbuhe.3ikfsb---redacted---cg3.7s3bnxqmavqy7sec.dojfgj.com lll.nu6toobygq3dsnjrgm.snksjg---redacted---dth.ejitjtk4g4lwvbos.amouc.com ooo.nu6tgnzvgm2tmmbzgq4a.rkgo---redacted---tw5.5z5i6fjnugmxfowy.beevish.com Base32 encoded machine identifier Base32 encoded & RSA 1024 encrypted card information previously unknown malware domains Trusted Networks

Summary Detecting exfiltration over DNS DNS lookups are a viable exfiltration mechanism  If you’re hunting for DNS exfiltration consider other options What system made the most DNS lookups last week?  Why? Has this changed? Model your data to spot anomalies quickly  What are these unexpected values? Trusted Networks