Although I know what the use of a DNS sinkhole is (I guess I do) I'm struggling to understanding how well scalable such solution is.

DNS sinkhole or black hole DNS is used to spoof DNS servers to prevent resolving host names of specified URLs. This can be achieved by configuring the DNS forwarder to return a false IP address to a specific URL.

I came cross the following discussion on Security StackExchange
How can someone sinkhole domains?

he CryptoLocker authors used the following scheme: the C&C registers random-looking domain names at a rather high rate (1000 per day !). The domain names are generated with a deterministic pseudo-random algorithm, that the malware knows too. Therefore, when CryptoLocker executes on a victim's computer, it tries to use one of the domain names du jour in order to talk to the C&C. The attacker's hope is that law enforcement agencies will have to go through heavy administrative bureaucracy to force the shut down of a domain name, and won't be able to do that 1000 times per day.

Later it says:

Since the malware knows the domain-generation algorithm, a researcher (Dimiter Andonov) reverse-engineered the code, and thus became able to predict the domain names in advance.

So I guess that more and more often authors of various types of malware take advantage of the approach as it was used in the CryptoLocker case - don't use one domain, use thousands of them but even if there's one single domain behind it, we need to first know it, configure our DNS Server to resolve to the IP of the DNS Sinkhole. Is it the way to do it ?

  • anyone ? thanks for your input in advance. – cyzczy Feb 12 '18 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.