2

When investigating malicious domains that are used for phishing, malware, etc, you often have to issue DNS queries for these domains.

For example:

dig @1.1.1.1 example.com

The potential risks of issuing this command are:

  • A maliciously crafted DNS record could try to exploit my DNS utility
  • A maliciously crafted DNS record could try to exploit my terminal
  • The DNS zone I am querying could be delegated to another, potentially malicious DNS server
  • Possible privacy violations[?]

Are there any other potential risks that I have missed or considerations that I should make?

Do you think that this is a valid concern?

2

Remember back when CVE-2015-7547 was disclosed by Google and RedHat? It was a high risk DNS security flaw that had gone undetected for years. It is unclear whether the issue had been exploited "in the wild" before then. DNS flaws are a real issue and you should consider it when querying random domain names.

When investigating suspicious domain names such as phishing and malware load them in a Virtual Machine - there is always the risk that untrusted code / data might compromise your system - consider your threat model and protect against it - let it be a throw-away one rather than your primary one.

Hope this helps :)

  • 2
    I agree, there is risk in doing DNS queries, but when e.g. surfing, your computer does a couple hundred of these on single websites (js cross loading, ads, cdn, static content from different servers...), so if your threat model involves "DNS queries are harmful", you'll probably have to live in a cave without electricity. – Marcus Müller Apr 6 '18 at 9:55
  • 1
    CVE-2015-7547 - that's an interesting one. I guess that if I'm seriously concerned about a full RCE exploit coming from DNS, then a VM-escape could be just as likely[?]. As @MarcusMuller says, looks like I might have to go down the cave route... – jamieweb Apr 6 '18 at 17:34
  • @JamieOnUbuntu Stacking exploits is a risk though that would likely only be used in a highly targeted attack. Again what’s your threat model? – Nathaniel Suchy Apr 6 '18 at 18:47
  • @NathanielSuchy I'm assuming the worst for absolutely everything - then if anything does happen I might be prepared for it. I assume that every attack is targeted. – jamieweb Apr 6 '18 at 21:08
  • @JamieOnUbuntu Then use a physically separate machine. That's your best option. Put on an isolated VLAN to avoid it from attacking other hosts on your network. – Nathaniel Suchy Apr 6 '18 at 21:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.