Mobile networks aren’t usually thought of as sources of spam, but a quick look at some of the resources that track spam reveals they actually are. This is counter intuitive at first glance because when most people think of mobile they think of smartphones, and those aren’t known to be sources of spam (at least not yet). What’s really going on is PCs connected to mobile networks with air cards, or tethered with a smartphone where it’s permissible, are the culprits. Bot infected PCs aren’t at all uncommon, and of course bots don’t especially care if they’re using a costly mobile data service to send their spam.
This blog has talked a lot about how the DNS can provide network-based security, and how DNS is in the best position to detect malware traffic before it does any harm.
But what does this mean for end users? How does it make their online lives easier and more secure?
Spam is a never-ending problem for service providers. Unfortunately criminals can still make money at someone else’s expense so they persist in their mindless campaigns. The DNS is an integral part of well-established techniques for handling incoming spam, so unwanted mail doesn’t get delivered to inboxes.
DNSSEC continues to gain momentum as network operators and domain owners watch and learn from early adopters. The learning process is made easier by efforts such as the ongoing work conducted by researchers at Sandia labs to methodically identify and categorize the kinds of problems that are occurring.
The situation surrounding DNS Changer highlights some interesting issues. Unless end users remove DNS Changer malware from their machines, those machines will always try and connect to the DNS server addresses encoded in the malware. Today they’ll connect to “clean” DNS servers that replaced the hackers DNS servers as a result of a court order. But those servers are unlikely to remain in place. This means at some point infected machines will lose their Internet connectivity.
Governments around the world are starting to pay attention to botnets and the damage they can inflict. Recently the Chairman of the US Federal Communications Commission (FCC), Julius Genachowski, called for action to address the bot problem and improve Internet security.
Like any critical part of network infrastructure, securing recursive DNS requires a layered approach. All the points of entry into the system – the console(s), network, etc need to be protected. Before we look at the types of protection we need to consider the various types of attacks against recursive DNS server infrastructure, they can be broadly categorized based on the attack target:
I first became familiar with DNSSEC around 2002 when it was a feature of the Bind9 server, which I was using to setup a new authoritative DNS platform for customers of the ISP I was working for. I looked at it briefly, decided it was too complex and not worth investigating. A couple of years later a domain of a customer got poisoned in another ISPs network. And while the DNS service we provided was working properly, the customers impression was we hadn’t protected them.
There was an intriguingly named vulnerability revealed this week: Ghost Domains. A paper describing it can be found here. A team of researchers in China discovered a way to allow a domain to remain reachable in the DNS even after it has been revoked from a TLD. It looks like they expended a lot of energy testing their new idea and discovered there are several caching DNS software releases that are vulnerable.
Your new DNS infrastructure is up and running! Here’s what to watch for, how to monitor, and tips for patches and upgrades.