Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible?

Snort Alert:

ET POLICY DYNAMIC_DNS .dyndns.org DNS Lookup - Possible Malware
share|improve this question

closed as not a real question by Rook, Scott Pack, Iszi, AviD♦ Aug 18 '12 at 20:42

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 1 down vote

A Socks 5 compatible proxy support DNS look-ups, and squid supports the sock 5 protocol. On a side note, TOR can make use of Sock 5 for their own DNS .onion domains. This is probably a false positive on behalf of snort, I don't see how this is a security issue.

share|improve this answer
Is there a log I could verify that with? – k to the z May 17 '12 at 14:53
It is a dyn dns query for chosenones.dyndns.org. That's what's in the payload. Dynamic dns queries are a security issue. I'm trying to find the machine that made the original request. All snort gave me was the proxy address. – k to the z May 17 '12 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.