1. Threat Analtics Data Exfiltration by DNS lookup
TELE3119:
Materials from Martin Lee of TALOS is gratefully acknowledged

2. Cyber Kill Chain Get Inside Find some data Exfiltrate it
Trusted Networks

3. Email attack: malware distributing ransomware
Getting Inside
attack: malware distributing ransomware
Trusted Networks

4. Exfiltrating Data ftp port 21 stolen data ssh port 22 http port 80
compromised system
malicious.com
Trusted Networks

5. Exfiltrating Data Block with FW rules or IP / domain block-list
ftp port 21
stolen data
ssh port 22
http port 80
compromised system
malicious.com
Block with FW rules or 
IP / domain block-list 
Trusted Networks

6. Exfiltrating Data Hypothetically speaking …
Could we exfiltrate and evade: 
IP blacklists 
Firewall rules 
Trusted Networks

7. DNS requests name server example.com local DNS server .com DNS server
what is the address for
it is:
“Dunno, I’ll ask someone else”
“Dunno, but I know some who does”
“I know the answer”
Trusted Networks

8. Exfiltrating Data by DNS
name server
malicious.com
local DNS server
reply:
DNS lookup for
top.secret.data.malicious.com
“top.secret.data”
compromised system
Trusted Networks

9. Exfiltrating Data by DNS
DNS lookup problems: 
Punctuation forbidden (limited to a-z & 0-9, no space or !)
Case insensitive 
Base64 Encoding ??
Base32 Encoding
“top secret data”  ORXXAIDTMVRXEZLUEBSGC5DB 
“Top Secret !!!!”  KRXXAICTMVRXEZLUEAQSCIJB 
DNS requests logs 
mail.domain2.com 
server.xyz.domain3.com 
ORXXAIDTMVRXEZLUEBSGC5DB.malicious.com 
long random string!
Trusted Networks

10. Let’s go hunting! Lets look for ‘long’ domain names.
OpenDNS DNS Lookup Data 
Lets look for ‘long’ domain names. 
Oh, great there are 100 million!
difficult to analyze data  need a model? 
Trusted Networks

11. Model data: distribution frequency
spike ???
the longer the length, the less frequent it becomes.
closely follows an exponential decay curve.
We know how to fit a curve to the data, how does exponential curve work.
We construct a model for our expectation of a subdomain length.
Subdomain length
Trusted Networks

12. Identify Anomalies we only analyse particular length Subdomain length
Trusted Networks

13. Active Exfiltration Pattern ? Stealing credit card data !
log.nu6timjqgq4dimbuhe.3ikfsb---redacted---cg3.7s3bnxqmavqy7sec.dojfgj.com lll.nu6toobygq3dsnjrgm.snksjg---redacted---dth.ejitjtk4g4lwvbos.amouc.com ooo.nu6tgnzvgm2tmmbzgq4a.rkgo---redacted---tw5.5z5i6fjnugmxfowy.beevish.com
Pattern ?
begins with 3 characters (i.e. log, lll, ooo), followed by a dot, followed by a long random string with a fingerprint (i.e. starts with nut6), followed by a dot, followed by a really long string, …
Stealing credit card data !
Trusted Networks

14. Point of Sale
malware would sniff the memory of PoS device to collect card numbers, Expiry date, etc
Trusted Networks

15. Active Exfiltration PoS malware domain
log.nu6timjqgq4dimbuhe.3ikfsb---redacted---cg3.7s3bnxqmavqy7sec.dojfgj.com lll.nu6toobygq3dsnjrgm.snksjg---redacted---dth.ejitjtk4g4lwvbos.amouc.com ooo.nu6tgnzvgm2tmmbzgq4a.rkgo---redacted---tw5.5z5i6fjnugmxfowy.beevish.com
Base32 encoded
machine identifier
Base32 encoded & RSA 1024 encrypted card information
previously unknown malware domains
Trusted Networks

16. Summary Detecting exfiltration over DNS
DNS lookups are a viable exfiltration mechanism 
If you’re hunting for DNS exfiltration consider other options
What system made the most DNS lookups last week? 
Why? Has this changed?
Model your data to spot anomalies quickly
 What are these unexpected values?
Trusted Networks