The hosting company of a client has shut down their Windows server twice in the past week because the server seems to be sending out massive amounts of outbound encrypted UDP DNS traffic.

I have now configured the firewall to block any incoming/outgoing traffic by default and only allowed the necessary ports. This should prevent the outgoing UDP traffic, but I still don't understand the underlying issue.

There is only a webserver (ASP.net website) and FTP server running on this server and so far I couldn't find any issues in the web application.

What are the attackers doing, are they DDoSing other servers? And how are they doing this, how to fix the root of this problem?

  • Where is the traffic going? Could be IPsec or some other VPN protocol. – Volker Mar 3 at 10:45
  • China, Hong Kong, Venezuela, Thailand, ... Here is a list of the IP addresses the traffic was sent to: pastebin.com/JxbhPzmF – saxum Mar 3 at 10:59
  • Can you tell which port was used in outbound connections? (DNS over UDP) – Rashad Novruzov Mar 3 at 15:29
  • AFAIK there's no encrypted DNS over UDP protocol. IPSec only signs the replies, but the repy itself is in the clear, not encrypted. So it might just be UDP traffic outbound to port 53 to disguise the true nature of the traffic. Many people might just ignore port 53 UDP traffic because it "looks normal" – Steve Sether Mar 3 at 15:49
  • Knowing the volume of the data, as well as seeing some of the packets themselves would tell you something. – Steve Sether Mar 3 at 15:56

This answer are being given taking in account the comments:

It seems that the attacker either using it as vpn hop server (more likely) or as data exfiltration (less likely, since I assume the target are not important)

The reason why I assume that this is most likely VPN over DNS hop server, is that at some point of time I've had to experience with one of my clients pretty close to the described scenario.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.