DNS Tunnelling: Risks, Detection, and Prevention Strategies

The Domain Name System (DNS) functions as a crucial intermediary by translating human-friendly domain names, such as example.in, into the numerical IP addresses necessary for devices to identify and connect to online resources. This process simplifies internet navigation, thereby optimising the efficiency of data access and retrieval across the network.

DNS is critical for a wide range of internet activities, so its traffic is often allowed through security systems and firewalls. The primary function of DNS is to resolve domain names, making it inherently flexible. DNS tunnelling exploits this flexibility by hiding malicious code within DNS requests, allowing malware to reach its intended destination.

Understanding DNS Tunneling

Let us begin by understanding the mechanism behind DNS Tunnelling. The attacker starts by registering a domain name that directs to their own server, where the malware is hosted. They then issue DNS requests, which many firewalls allow through. Once the host's PC is infected, it sends requests to the DNS resolver to retrieve the necessary IP addresses. With the connection established, it can be used for various malicious activities.

Types of DNS Tunnelling Uses

Legitimate Uses: 

• Network Diagnostics and Testing
• Remote Administration
• Bypassing Network Restrictions
• Secure Data Transfer
• Research and Development

Malicious Uses:

• DNS Tunneling Attacks
• Data Exfiltration
• Command and Control (C2) Communication
• Evasion of Security Measures
• Malware Distribution

Signs of DNS Tunnelling

• Uncommon Domain Requests: To differentiate between DNS tunnelling traffic and regular DNS traffic, a closer inspection of the domain names in DNS queries is necessary.
• High DNS Traffic Volume: Malicious activities, such as data exfiltration or extensive command and control operations, typically involve a high volume of DNS requests. Given that a requested domain name can be up to 253 characters long, DNS tunnelling traffic becomes more apparent with increased volume.
• Payload Analysis: Regularly checking for specific indicators is crucial.
• Size of the Query and Answer: Abnormal sizes may indicate tunnelling.
• Uncommon Hostnames: Hostnames composed of simple words or numbers without encoding may be a sign.
• Uncommon DNS Record Types: Unusual DNS record types can indicate policy violations.
• Traffic Analysis: To detect unusual activity, monitor;
  a) DNS Traffic Volume: Assess traffic across all IP addresses and domains.
  b) Number of Hostnames: Examine the number of hostnames in each domain.
  c) DNS Server Location: Track the real-time location of DNS servers that handle incoming queries.

Tools & Techniques for detecting DNS Tunnelling

Anomaly Detection: An anomaly is an unusual occurrence that stands out. Look for patterns or specific behaviours that seem strange or suspicious. This approach requires continuous monitoring of DNS traffic. What constitutes an unusual query will depend on the network or organization.

Rate-Limiting This technique restricts the number of DNS requests that can be made from a specific source within a given time frame. However, it has a drawback: it may slow down legitimate DNS traffic, potentially affecting the entire network.

Intrusion Detection System (IDS) Intrusion Detection Systems (IDS) are specialized software designed to enhance security by monitoring all DNS traffic for suspicious activities. Keeping this software up-to-date is crucial for accurately detecting DNS tunnelling.

Mitigation Strategies

• Regularly Updating and Patching DNS Servers
  Regularly updating all your systems, network devices, and software when updates are available is essential for protecting against DNS tunnelling and other malicious attacks. Additionally, integrating a quality anti-malware solution can provide a strong defence around your data and network.
• Implementing DNS Firewalls and Advanced DNS Security Solutions
  Advanced DNS firewalls and security solutions can check for policy violations and automatically block any malicious requests. They also update automatically with information about new threats, protecting your organization from dangers such as data exfiltration, phishing, ransomware attacks, and malware.
• Using Network Monitoring Tools to Track Abnormal DNS Traffic Patterns
  Monitoring DNS traffic is one of the most effective long-term preventive measures, helping to protect data from DNS tunnelling.
• Employing Behavioral Analytics to Identify Suspicious Activities
  Behavioural analytics can automatically identify outliers and suspicious activities. Block requests for sites that were not requested by your staff and ban specific IP addresses, domain names, or real-time locations that seem suspicious to mitigate the risk of DNS tunnelling.

Best Practices

• Educating Staff and IT Teams About DNS Threats: Educating employees and IT teams about DNS vulnerabilities and how attackers exploit them using various methods will raise awareness. Inform them about the risks of clicking on unsolicited links, emails, or engaging in actions that could spread malware.
• Configuring DNS Zones Securely: Securing your DNS server and restricting access to sensitive or confidential domains is crucial. Properly configuring your DNS zones helps protect against harmful DNS queries and safeguards sensitive data from DNS tunnelling.
• Enforcing Strict Outbound Traffic Policies: To enhance DNS infrastructure security, configure operating systems to use only authorized DNS servers for all outbound DNS traffic and restrict access to permitted servers.

Conclusion

DNS tunnelling is a covert technique used by attackers for various malicious purposes, including damaging your company's reputation or causing significant financial losses through the exfiltration of confidential data. To prevent DNS tunnelling and maintain the operational efficiency of your organization, enforce robust security measures and update them regularly.