1

When investigating malicious domains that are used for phishing, malware, etc, you often have to issue DNS queries for these domains.

For example:

dig @1.1.1.1 example.com

The potential risks of issuing this command are:

  • A maliciously crafted DNS record could try to exploit my DNS utility
  • A maliciously crafted DNS record could try to exploit my terminal
  • The DNS zone I am querying could be delegated to another, potentially malicious DNS server
  • Possible privacy violations[?]

Are there any other potential risks that I have missed or considerations that I should make?

Do you think that this is a valid concern?

1 Answer 1

2

Remember back when CVE-2015-7547 was disclosed by Google and RedHat? It was a high risk DNS security flaw that had gone undetected for years. It is unclear whether the issue had been exploited "in the wild" before then. DNS flaws are a real issue and you should consider it when querying random domain names.

When investigating suspicious domain names such as phishing and malware load them in a Virtual Machine - there is always the risk that untrusted code / data might compromise your system - consider your threat model and protect against it - let it be a throw-away one rather than your primary one.

Hope this helps :)

6
  • 2
    I agree, there is risk in doing DNS queries, but when e.g. surfing, your computer does a couple hundred of these on single websites (js cross loading, ads, cdn, static content from different servers...), so if your threat model involves "DNS queries are harmful", you'll probably have to live in a cave without electricity. Commented Apr 6, 2018 at 9:55
  • 1
    CVE-2015-7547 - that's an interesting one. I guess that if I'm seriously concerned about a full RCE exploit coming from DNS, then a VM-escape could be just as likely[?]. As @MarcusMuller says, looks like I might have to go down the cave route...
    – jamieweb
    Commented Apr 6, 2018 at 17:34
  • @JamieOnUbuntu Stacking exploits is a risk though that would likely only be used in a highly targeted attack. Again what’s your threat model?
    – user115400
    Commented Apr 6, 2018 at 18:47
  • @NathanielSuchy I'm assuming the worst for absolutely everything - then if anything does happen I might be prepared for it. I assume that every attack is targeted.
    – jamieweb
    Commented Apr 6, 2018 at 21:08
  • @JamieOnUbuntu Then use a physically separate machine. That's your best option. Put on an isolated VLAN to avoid it from attacking other hosts on your network.
    – user115400
    Commented Apr 6, 2018 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .