Unexplained DNS connections on boot

Question

I was on an Ubuntu VPS today, with a bind9 DNS server (without DNSSEC configured) installed and running.

Immediately after booting the machine I ran:

netstat -tanp

And received this output:

Proto Recv-Q Send-Q Local Address                   Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306                  0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80                      0.0.0.0:*               LISTEN      -                   
tcp        0      0 <redacted>:53               0.0.0.0:*               LISTEN      -                   
tcp        0      0 <redacted>:53               0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:53                    0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53                   0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22                      0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:25                      0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:953                   0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:443                     0.0.0.0:*               LISTEN      -                   
tcp        0      0 <redacted>:41430            91.189.91.26:80         TIME_WAIT   -                   
tcp        0      0 <redacted>:42885            192.112.36.4:53         TIME_WAIT   -                   
tcp        0     36 <redacted>:22               <redacted>:50294        ESTABLISHED -                   
tcp        0      0 <redacted>:45229            192.112.36.4:53         TIME_WAIT   -                   
tcp        0      0 <redacted>:35011            192.112.36.4:53         TIME_WAIT   -                   
tcp        0      0 <redacted>:56401            192.112.36.4:53         TIME_WAIT   -                   
tcp        0      0 <redacted>:41434            91.189.91.26:80         TIME_WAIT   -                   
tcp6       0      0 :::53                           :::*                    LISTEN      -                   
tcp6       0      0 :::22                           :::*                    LISTEN      -                   
tcp6       0      0 :::25                           :::*                    LISTEN      -                   
tcp6       0      0 ::1:953                         :::*                    LISTEN      -  

Which indicated that the server was connected to two different IP addresses other than my own:

91.189.91.26:80

Which appears to be owned by "Canonical Group" who according to my research produces Ubuntu, and could possibly make sense considering it is an Ubuntu machine... (any clarification would be appreciated with respect to the legitimacy of such a request).

but slightly more concerning:

192.112.36.4:53 (Department of Defense Network Information Center?)

Both of the above connections disappeared within a few seconds of booting the machine.

The second time I booted this machine and ran through the same process I got this output:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 <redacted>:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 <redacted>:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      -                   
tcp        0      0 <redacted>:42763    192.203.230.10:53           TIME_WAIT   -                   
tcp        0      0 <redacted>:43359    192.203.230.10:53           TIME_WAIT   -                   
tcp        0      0 <redacted>:34985    192.203.230.10:53           TIME_WAIT   -                   
tcp        0     36 <redacted>:22       <redacted>:50504            ESTABLISHED -                   
tcp        0      0 <redacted>:52257    192.203.230.10:53           TIME_WAIT   -                                      
tcp6       0      0 :::53                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::25                   :::*                    LISTEN      -                   
tcp6       0      0 ::1:953                 :::*                    LISTEN      - 

192.203.230.10:53 (NASA?)

Again the connections disappeared a few seconds after boot.

What's even weirder is that both of these IPs show up here as being diagnosed as IP connections related to malware going by the name of Troj/Sinowal-BI.

What is the likelihood that there would be legitimate DNS requests to these relatively serious networks immediately after booting a machine that has officially nothing to do with them and zero intentional configuration to do so?

If there was a rootkit installed on the box, the output of netstat should not be trusted, but why wouldn't a rootkit just hide those connections instead of spoofing them to perhaps look like DoD and NASA?

Should this machine be treated as compromised based on this information?

Could anyone provide any insight into this, or has anyone else experienced this or anything similar to it?

Answer 1

In short: No need to worry.

Regarding 91.189.91.26:80:

This is a request to a web server on the standard HTTP port. Most Ubuntu machines are installed in a way that after booting, they will want to check for updates by downloading some packages list from Canonical servers or mirrors thereof. And they will usually repeat that once in a while.

Try and sniff that network traffic and I am 99.9% sure it will turn out to be just that.

If you don't want this to happen, search the inner workings of Ubuntu to identify the script which does that and disable it; though that would be a question for Ubuntu StackExchange.

Regarding:

192.112.36.4:53 and 192.203.230.10:53

These are DNS queries to root DNS servers. It's perfectly normal that they are run by NASA and DARPA among others. Check out the Wikipedia article about root DNS servers at https://en.wikipedia.org/wiki/Root_name_server. It explains it pretty well.

The trojan you are referring to (by the way a Windows executable, which is very unlikely to infect an Ubuntu VPS) obviously seems to make use of DNS queries. The trojan may be programmed in a way to always do full recursive authoritative DNS queries on its own instead of relying on the DNS resolution of the underlying OS so it will not be blocked by some DNS-based anti-threat software. But drawing the conclusion the other way round (i.e. if a trojan is calling that address it must be evil) is simply wrong.