Two weeks ago I wrote blog post about importance of DNS visibility – https://letsnet.eu/dns-over-tls-dns-over-https/. Let’s assume that DNS traffic is properly inspected, queries to malicious domains can be seen and you have capabilities to identify DNS tunneling and to block it as well. Is blocking a proper action to malicious DNS queries? Not really, let’s elaborate using below scenario.
Infected host is trying to talk to C&C server which is under domain dfb.7rz.ru, first host has to find out ip address of C&C server. Host is asking local DNS server, than DNS server is asking external DNS server. Firewall is seeing that dfb.7rz.ru domain has bad reputation and as an action firewall is not simply blocking DNS query, but replying to local DNS server with sinkhole ip address which is 1.2.3.4 in that case. DNS server than is replying to host that dfb.7rz.ru is under 1.2.3.4 and right know compromised host is sending some data to C&C server. What is a benefit of sinkholing comparing to blocking? Using sinkhole you can simply identify probably compromised hosts, just by filtering traffic log to destination ip address 1.2.3.4. When malicious DNS queries are just blocked, than you will see in the logs only that DNS server is asking about bad domains and unfortunately no clue who initiated malicious traffic actually. Simply blocking means lack of visibility.
How it works, let’s see in my lab. I’m asking about ip address of 110retail.com which was marked as malicious by CERT Poland, sinkhole disable:
Sinkhole enable:
172.30.100.250 is ip address of DNS server in my lab, without sinkhole, we will see only query from DNS server.
172.30.100.104 is ip address of end host in my lab. Like you can see below, host is trying to communicate with sinkhole ip and as outcome, probably compromised hosts can be identified.
Sinkhole is pretty simple concept and powerful at once.