Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My IDS picked up our squid proxy server doing a dynamic DNS request. I wasn't aware squid passed DNS requests from the client to the internal DNS server. Is this possible?

Snort Alert:

ET POLICY DYNAMIC_DNS .dyndns.org DNS Lookup - Possible Malware
share|improve this question

closed as not a real question by Rook, Scott Pack, Iszi, AviD Aug 18 '12 at 20:42

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

A Socks 5 compatible proxy support DNS look-ups, and squid supports the sock 5 protocol. On a side note, TOR can make use of Sock 5 for their own DNS .onion domains. This is probably a false positive on behalf of snort, I don't see how this is a security issue.

share|improve this answer
    
Is there a log I could verify that with? –  k to the z May 17 '12 at 14:53
    
It is a dyn dns query for chosenones.dyndns.org. That's what's in the payload. Dynamic dns queries are a security issue. I'm trying to find the machine that made the original request. All snort gave me was the proxy address. –  k to the z May 17 '12 at 15:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.