4

I have been looking into OpenDNS as something to possibly use at my company, and they claim that Cryptolocker-style ransomware almost always uses DNS to "phone home" and that OpenDNS blocks this, preventing the ransomware from doing anything malicious. This seems a bit dubious to me, as I would think that malware creators would either hardcode IPs or hardcode DNS server IPs (like a shady version of 8.8.8.8) instead of using the OS's default DNS server. I get that hardcoded IPs for the botnet-controller (or wherever the malware is phoning home to) would be problematic if that IP gets shut down or blocked, but I imagine they could use a different DNS that would continue to resolve their hostname even if they were using it nefariously.

Am I missing something? Is this truly how ransomware acts in the wild, or is this claim just marketing? Is there any technical reason ransomware would use the OS DNS server and couldn't use its own?

3 Answers 3

2

Yes this will block it. Using a hardcoded IP address for anything as a cracker is an awful idea as it ties you to a single point. If you're a cracker you want to stay mobile, moving, and in such a way they can't find you. Being tied to a single, static IP address makes you REALLY easy to find. Otherwise you would first have to send a new version of the malware with the DNS for tomorrow, and then that pattern could EASILY get you found once someone just connects manually, get the new malware, pulls out the DNS, finds the IP registered for tomorrow, goes and lies in wait, and then you're caught.

This problem gets solved on their end by using a DNS to keep floating IP addresses tied to their domains. This DNS needs to be contacted to "phone home" to a server that will send the botnet a command. OpenDNS logs these malicious botnets, and blocks them on a DNS level, so the OS and infected computer has no idea that it can't even reach the botnet. It just thinks that the cracker isn't doing anything right now, and so it doesn't join the botnet. To do this OpenDNS just prevents access to those servers.

2
  • I guess I still don't understand why the malware would use the OS's DNS server only. I would think including if(domainnameresolves){ doBadStuff() } else { useSomeOtherDNS() } would seem better than giving up and doing nothing if the system DNS doesn't yield an IP. Oct 15, 2015 at 17:54
  • DNS servers are just computers. Computers have IP addresses. IP addressees are linked to physical locations, logs, and many tracking service that make anyone who uses them easy to find. DNS server do NOT have a domain name. They are accessed by IP address only. Because of this hard coding them locks into a physical location in real life, they want nothing to do with it. It's easier and safer to update the OS DNS and try that, fallback and update again, try that, update and try again... Oct 15, 2015 at 18:05
0

some new next generation firewalls intercept DNS queries even if they are sent to 8.8.8.8 or any other public DNS Service. I guess OpenDNS guys will always respond to the malware with an IP address they own so that the malware sends the traffic to that IP where they can analyze and block the malicious content.

firewalls like Palo Alto do the same by checking if a DNS query contain known malicious domain. The device can respond with an IP address you setup so that the malware forwards traffic to it. I advice you to read a bit about DNS Sinkhole, Malicious Domain list, threat intelligence

0

Answer to your question: Yes it helps. But it's a race against time.

In cases if your computers were infected, the malware must still dial back to the attacker's C&C server to send over the encryption key over to encrypt your hard-disk and for the attacker to identify you so attackers would know who paid and which decryption key to release. Also, a bitcoin address is shown to you for payment.

Unless highly-motivated attacks are targeted against you only, attackers are simply casting a net via phishing emails and social media mal-vertisements and waiting for victims to take the bait. What I find scary are drive-by infections where malicious websites exploit vulnerabilities in browser plugins like Flash Player, Java, Adobe Reader or Silverlight. When users visit that infected link, their computers can get infected.

This leads me to:

IP and URL Intelligence services rely on a dedicated team of security operators analyzing their customer's network behaviour on top of their analytics engine.

On lucky days, the SOC team might detect and close down a malicious site before a user becomes "patient zero" and is the first to be victimized.

I am not from an SOC team but I would guess that the major breaches reported on the news often get detected via the first unfortunate victim who reported the attack. Especially on Advanced Persistent Threats where perhaps an attacker is waiting to encrypt your files when he realized you are working on a million dollar deal or when you are doing a year end audit/sales review.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .