Is Your DNS Vulnerable?

This article originally appeared on F5.com on 7.29.15.

A recent report from The Infoblox DNS Threat Index (in conjunction with Internet Identity) shows that phishing attacks has raised the DNS threat level to a record high of 133 for second quarter of 2015, up 58% from the same time last year. The biggest factor for the jump is the creation of malicious domains for phishing attacks. Malicious domains are all those very believable but fake sites that are used to mimic real sites to get you to enter sensitive details. You get a phishing email, you click the link and get sent to a financial site that looks and operates just like your real bank site. If you're fooled and enter your credentials or other personal information, you could be giving the bad guys direct access to your money. These sites can also pretend to be corporate portals to gather employee credentials for future attacks.

Along with the malicious domains, demand for exploit kits also helped propel the DNS threat. Exploit kits are those wonderful packaged software that can run, hidden, on websites and load nasty controls and sniffers on your computer without you even knowing.

The Infoblox DNS Threat Index has a baseline of 100, which is essentially the quarterly averages over 2013 and 2014. In the first quarter 2015, the threat index jumped to 122 and then another 11 ticks for Q2 2015, hitting the high mark. Phishing was up by 74% in the second quarter and Rod Rasmussen, CTO at IID, noted that they saw a lot of phishing domains put up in the second quarter. You'd think after all these years this old trick would die but it is still very successful for criminals and with domain names costing less than $20 and available in minutes, it is a cheap investment for a potentially that big score.

DNS is what translates the names we type into a browser (or mobile app, etc.) into an IP address so that the resource can be found on the internet. It is one of the most important components to a functioning internet and as I've noted on several occasions, something you really do not think about until it isn't working...or is hacked. Second to http, DNS is one of the most targeted protocols and is often the source of many attacks. This year alone,  the St. Louis Federal Reserve suffered a DNS breach, Malaysia Airlines' DNS was hacked, and Lenovo.com to name a few. In addition, new exploits are surfacing targeting vulnerable home network routers to divert people to fake websites and DNS DDoS is always a favorite for riff-raff. Just yesterday 3 people were sent to prison in the DNS Changer Case.

With more insecure IoT devices coming on line and relying on DNS for resolution, this could be the beginning of a wave of DNS related incidents. But it doesn't have to be. DNS will become even more critical as additional IoT devices are connected and we want to find them by name. F5 DNS Solutions, especially DNSSEC solutions, can help you manage this rapid growth with complete solutions that increase the speed, availability, scalability, overall security and intelligently manages global app traffic. At F5 we are so passionate about DNS hyperscale and security that we are now even more focused with our new BIG-IP DNS (formerly BIG-IP GTM) solution.

ps

@psilvas

Related:

• Phishing Attacks Drive Spike In DNS Threat
• The growing threat of DDoS attacks on DNS
• Infoblox DNS Threat Index Hits Record High in Second Quarter Due to Surge in Phishing Attacks
• Infoblox DNS Threat Index
• Eight Internet of Things Security Fails
• Intelligent DNS Animated Whiteboard (Video)
• CloudExpo 2014: The DNS of Things (Video)
• DNS Doldrums

Technorati Tags: breach,dns,f5,phishing,securitymalware,threats,silva

Connect with Peter:	Connect with F5:

A Living Architecture

You often hear people say, 'oh, this is a living document,' to indicate that the information is continually updated or edited to reflect changes that may occur during the life of the document. Your infrastructure is also living and dynamic. You make changes, updates or upgrades to address the ever changing requirements of your employees, web visitors, customers, partners, networks, applications and anything else tied to your systems.

This is also true for F5's Reference Architectures. They too are living architectures.

F5's Reference Architectures are the proof-points or customer scenarios that drive Synthesis to your data center and beyond.

When we initially built out these RA's, we knew that they'd be continuously updated to not only reflect new BIG-IP functionality but also show new solutions to the changing challenges IT faces daily. We've recently updated the Intelligent DNS Scale Reference Architecture to include more security (DNSSEC) and to address the highly hybrid nature of enterprise infrastructures with Distributed DNS.

F5’s end-to-end Intelligent DNS Scale reference architecture enables organizations to build a strong DNS foundation that maximizes the use of resources and increases service management, while remaining agile enough to support both existing and future network architectures, devices, and applications. It also provides a more intelligent way to respond and scale to DNS queries and takes into account a variety of network conditions and situations to distribute user application requests and application services based on business policies, data center conditions, network conditions, and application performance. It ensures that your customers—and your employees—can access your critical web, application, and database services whenever they need them.

In this latest DNS RA rev, DNSSEC can protect your DNS infrastructure, including cloud deployments, from cache poisoning attacks and domain hijacks. With DNSSEC support, you can digitally sign and encrypt your DNS query responses. This enables the resolver to determine the authenticity of the response, preventing DNS hijacking and cache poisoning.

Also included is Distributed DNS. Meaning, all the DNS solution goodness also applies to cloud deployments or infrastructures where DNS is distributed.  Organizations can replicate their high performance DNS infrastructure in almost any environment. Organizations may have Cloud DNS for disaster recovery/business continuity or even a Cloud DNS service with signed DNSSEC zones. F5 DNS Services enhanced AXFR support offers zone transfers from BIG-IP to any DNS service allowing organizations to replicate DNS in physical, virtual, and cloud environments. The DNS replication service can be sent to other BIG-IPs or other general DNS servers in Data Centers/Clouds that are closest to the users.

In addition, Organizations can send users to a site that will give them the best experience. F5 DNS Services uses a range of load balancing methods and intelligent monitoring for each specific app and user. Traffic is routed according to your business policies and current network and user conditions. F5 DNS Services includes an accurate, granular geolocation database, giving you control of traffic distribution based on user location.

DNS helps make the internet work and we often do not think of it until we cannot connect to some resource. With the Internet of Nouns (or Things if you like) hot on our heels, I think Port 53 will continue to be a critically important piece of the internet puzzle.

ps

Related:

• Intelligent DNS Scale Resources
• F5 Synthesis
• DNS Reimagined keeps your Business Online
• DNS Does the Job
• The DNS of Things
• DNS Doldrums
• The Internet of Things and DNS

 

Technorati Tags: f5,big-ip,dns,reference architecture,dnssec,iot,things,name_resolution,silva,security,cloud,synthesis

 

Connect with Peter:	Connect with F5:

The DNS of Things

Hey DNS - Find Me that Thing!

There's a new craze occurring in homes, highways, workplaces and everywhere imaginable - the Internet of Things or as I like to call it, The Internet of Nouns. Sensors, thermostats, kitchen appliances, toilets and almost every person, place or thing will have a chip capable of connecting to the internet. And if you want to identify and find those things with recognizable words instead of a 128-bit IP address, you're going to need DNS.

DNS translates the names we type into browser or mobile app into an IP address so the services can be found on the internet. It is one of the most important components of the internet, especially for human interaction. With the explosion of mobile devices and the millions of apps deployed to support those devices, DNS growth has doubled in recent years. It is also a vulnerable target.

While the ability to adjust the temperature of your house or remotely flush your toilet from around the globe is cool, I think one of the biggest challenges of the Internet of Nouns will be the strain on DNS. Not only having to resolve the millions of additional 'things' getting connected but also the potential vulnerabilities and risks introduced when your washing machine connects to the internet to find the optimal temperature and detergent mix to remove those grass, wine and blood stains.

Recent research suggests that the bad guys are already taking advantage of these easy targets. Arstechnica reports that the malware that has been targeting routers has now spread to DVRs. Not my precious digital video reorder!! Last week, Sans found a Bitcoin mining trojan that can infect security camera DVRs. As they were watching a script that hunted the internet for data storage devices, they learned that the bot was coming from a DVR. Most likely, they say, it was compromised through the telnet defaults.

In another report, ESET said it found 11 year old malware that had been updated with the ability to compromise a residential broadband router's DNS settings. The malware finds a vulnerable router and changes the default DNS entries to either send the person to a rogue site to install more malware (join the bot, why don't ya) or to just redirect them to annoying sites. Imagine if the 50+ connected things we will soon have in our homes also joined the bot? Forget about needing compute and bandwidth from machines around the globe, you can zero in on a neighborhood to launch an attack.

Nominum research shows that DNS-based DDoS amplification attacks have significantly increased in the recent months, targeting vulnerable home routers all over. A simple attack can create tens-of-gigs of traffic to disrupt networks, businesses, websites, and regular folks anywhere in the world. More than 24 million home routers on the Internet have open DNS proxies which expose ISPs to DNS-based DDoS attacks and in February 2014 alone, more than 5.3 million of these routers were used to generate attack traffic. These are especially hard to track since it is difficult to determine both the origination and target of the attack.

Lastly, Ultra Electronics AEP says 47% of the internet remains insecure since many top level domains (TLDs) have failed to sign up to use domain name system security extensions (DNSSEC). These include heavy internet using countries like Italy (.it), Spain (.es) and South Africa (.za), leaving millions of internetizens open to malicious redirects to fake websites. Unless the top level domain is signed, every single website operating under a national domain can have its DNS spoofed and that's bad for the good guys.

We often don't think about the Wizard behind the curtain until we are unable resolve an internet resource. DNS will become even more critical as additional nouns are connected and we want to find them by name. F5 DNS Solutions can help you manage this rapid growth with complete solutions that increase the speed, availability, scalability, and security of your DNS infrastructure.

And I do imagine a time when our current commands could also work on, for instance, the connected toilet: /flushdns.

Just couldn't let that one go.

ps

Related:

• “Internet of Things” is the new Windows XP—malware’s favorite target
• Win32/Sality newest component: a router’s primary DNS changer named Win32/RBrute
• 24 million home routers expose ISPs to massive DNS-based DDoS attacks
• 24 million reasons to lock down DNS amplification attacks
• Half the internet lacks DNS security extensions
• F5 Intelligent DNS Scale

 

Technorati Tags: f5,dns,dnssec,ddos,security,iot,things,big-ip,malware,silva,trojan

 

Connect with Peter:	Connect with F5:

RSA 2014: DDoS Protection (feat Bocchino)

F5 Sr. Systems Architect Ken Bocchino shows me a live demonstration of how F5’s protects the fundamental elements of an application (network, DNS, SSL and HTTP) against aggressively evolving DDoS attacks. Ken is always a fun and interesting guest.

ps
Related

• RSA 2014: Find F5
• RSA 2014: Anti-Fraud Solution (feat DiMinico)
• RSA 2014: Secure Web Gateway (feat Moses)
• F5 at RSA 2014
• F5 Secure Web Gateway – Reference Architecture
• F5 Web Fraud Protection – Reference Architecture
• F5 Expands Synthesis Architecture with Advanced Web and Fraud Protection Services for Worry-Free Application and Internet Access
• F5 YouTube Channel

Technorati Tags: rsac,f5,rsa,security,big-ip,silva,video,anti-fraud,anti-malware,swg,ddos,reference architecture

Connect with Peter:	Connect with F5:

DNS Does the Job

Imagine how much you'd use the internet if you had to remember dozens of number combinations to do anything.  DNS is arguably the primary technology enabling the Internet – translating the domain names people type into a browser into an IP address so the requested service can be found on the internet.  We always expect DNS to work and no one thinks about it until it breaks.

Every icon, URL, and all embedded content on a web page requires a DNS look up. Loading complex sites may require hundreds of DNS queries and even simple smart phone apps can require numerous DNS queries just to load. In the last five years, the volume of DNS queries on for .com and .net addresses has more than doubled, increasing to an average daily query load of 77 billion in the fourth quarter of 2012.   More than six million domain names were added to the Internet in the fourth quarter of 2012.  Future growth is expected to occur at an even faster pace as more cloud implementations are deployed and practically everything connected to the internet, including your future fridge, coffee machine and toilet will need a DNS entry

Over the last 5 years, there has been a 180% growth of active websites, 230% growth in active users, a 22% growth in software applications and 100% growth in DNS queries. Add to that, nearly 60% of web users say they expect a website to load on their mobile phone in 3 seconds or less. Organizations are experiencing rapid growth in terms of applications and the volume of traffic accessing those applications.

When a user requests a web page, the requests access local DNS services and these in turn communicate with the main DNS servers. This is not a problem until a traffic surge or a hacker floods the server with DNS query requests since it might be more than what the DNS servers can handle which in turn, can disable the main DNS server. The DNS server then stops responding and sites are unavailable, unreachable or even offline. Generally organizations have a set of DNS servers, each one capable of handling up to 150,000 DNS queries per second. High performance DNS servers are capable of handling around 200,000 queries per second. The bad guys can easily exceed that as exemplified by the recent DNS outages affecting NY Times, LinkedIn, Network Solutions and Twitter. DNS failures account for 41% of web infrastructure downtime so organizations must keep their DNS available. According to a survey by the Aberdeen Group, organizations lose an average of $138,000 for every hour their data centers are down.  Downtime has an impact on visiting customers, can lead to loss of revenue and can also impact employees trying to access their corporate resources.  To address DNS surges, companies add more DNS servers which are not really needed during normal business operations.

Instead of worrying about DNS outages and purchasing additional DNS infrastructure to combat surges, simply place BIG-IP in front of your primary DNS server. It’s a full DNS server and handles requests on behalf of your main DNS server.  BIG-IP can respond much faster to a DNS query request up to millions of queries per second. Whether it is a legitimate request or an attack, BIG-IP responds. The BIG-IP engine handles application requests at very high levels and it is that same engine that responds to DNS queries. So high, in fact, that even large surges of DNS requests (including the malicious ones) will not cripple your critical content. DNS is always available which is important to having good services for your users. Administrators enjoy the peace of mind that their site will respond to all DNS queries, keeping the site available.

 

If you have high volume DNS coming into your data center, it is more advantageous to respond to those queries from the DMZ rather than from deep within the infrastructure, potentially affecting the back end primary DNS servers along with other critical servers. Instead of responding from deep within the infrastructure, respond using BIG-IP from the DMZ so that no request touches the back end which greatly increases the primary server’s ability can scale. Offload DNS to BIG-IP. With these large scale capabilities, even if a site is flooded due to some unexpected event, DNS can respond to all queries, good or bad. This keeps all your critical web, application and database services available. Organizations can secure DNS while achieving high scale. There is less equipment to purchase, manage and support. Plus, BIG-IP offers easy DNS management that integrates with your existing infrastructure. Error checking, auto population of protocols and importation of zones help eliminate any downtime from DNS errors. Organizations can make their applications fast, available and secure but if DNS is not responding, it doesn’t really matter since no one can get to it anyway.

ps

Related:

• f5 Synthesis
• F5 Introduces Synthesis Architecture
• Intelligent DNS Scale Video
• DNS Solutions
• Scaling DNS Services with BIG-IP Devices
• So That DNS DDoS Thing Happened
• DNS Doldrums
• RSA2013: BIG-IP DNS Services (Video)
• F5 DNS Express: DNS Die Another Day (Video)

Technorati Tags: dns,dns attack,availability,synthesis,dns express,big-ip,f5,silva,reference architecture

 

Connect with Peter:	Connect with F5:

DNS Doldrums

DNS is one of the primary technologies enabling the Internet – translating the names people type into a browser into an IP address so the requested service can be found on the internet. It is one of the key elements in the network that delivers content and applications to the user.  If DNS goes down, most web applications will fail to function properly so it is critical to have a strong, secure and scalable DNS infrastructure.

A bunch of recent DNS outages show that while protecting the application from the typical SQLi, XSS and other OWASP Top 10 related risks is important, if DNS is not answering, those application hacks do not really matter since no one can get to the site anyway.

This month, 3 Dutch web hosting companies had their name servers altered by attackers.  They, according to articles, changed the various company's name servers to malicious servers hosted by the crooks.  They apparently managed to break into the national domain registrar, SIDN, to make the malicious change along with setting the Time to Live value to 24 hours.  This meant that any ISP that cached the bad information would continue to deliver the wrong address for the next day.  Among others, a large Dutch electronic retailer had to take down a bunch of servers that were delivering malware due to the breach but thousands of domains were affected.

This past June, the popular business social network LinkedIn was offline for at least a half a day due to a DNS issue.  The company claims that this was not due to criminal behavior but internal human error.  Somehow the main home page was redirected to a domain parking page which indicated the name was up for sale.

Also in June, DNSimple detected a DNS Amplification Attack on their network.  This is where an attacker attempts to use additional servers to 'amplify' the attack - small queries that turn into huge responses.  Instead of allowing the bounce, DNSimple tried to absorb the attack by blocking some IP addresses but ultimately at some point, all the name servers were no longer responding.  All hands to respond.  In their incident report, they noted that their current DNS server implementation allowed ANY queries on UDP to pass through and attempted to respond to them, albeit with the TC (truncation) bit set. In addition, the overhead created by their ALIAS resolution system was also a factor, especially with ALIAS records pointing to other records within DNSimple.  With some adjustments they hope to mitigate this from happening again.

There were a few others of note, In June, Network Solutions had its DNS servers hijacked and reconfigured to a malicious website after it botched efforts to thwart a DDoS attack.  The Spamhaus Project was nailed by a DNS DDoS attack.  And last week, a reported vulnerability in the BIND DNS software could give an attacker the ability to easily and reliably control queried name servers.

We rely on DNS for almost every interaction we have with web applications.  It helps us find our favorite e-tailer, social network, travel, news, gaming or entertainment site along with potentially finding our work related resources when we are mobile.  For organizations, it helps direct and bring people to your content.  Without it, our letter managed mind would have to start remembering a bunch of numbers.  Imagine how much you'd use the internet if you had to remember dozens of number combinations to do anything.  I bet the growth, the internet of everything, would come to a screeching halt.

ps

Related:

• BIND Vulnerability Enables DNS Cache Poisoning Attack
• DNS impairment redirects thousands of websites to malware
• How Spamhaus’ attackers turned DNS into a weapon of mass destruction
• LinkedIn hit by outage from 'DNS issue'
• Incident Report: DNS Outage due to DDoS Attack
• DDoS Attack Behind Latest Network Solutions Outage
• How whitehats stopped the DDoS attack that knocked Spamhaus offline
• The Domino Effect of LinkedIn’s DNS Outage
• RSA2013: BIG-IP DNS Services (video)
• F5 DNS Express: DNS Die Another Day (video)
• F5 DNS Series (videos)

Technorati Tags: dns,f5,outage,dns attack,ddos,security,bind,cache poisoning,big-ip,silva

Connect with Peter:	Connect with F5:

RSA2013: BIG-IP DNS Services

Taking a moment from behind the camera to appear in frame with me, F5 PMM Jonathan George shares some excellent insight, along with a well-drawn whiteboard, on all the ways BIG-IP can secure and optimize your DNS services. Jonathan also closes out the video in style. This one was especially fun.

 

ps

Related:

• RSA2013: Aloha from RSA
• RSA2013: Find F5
• RSA2013: Gimme 90 Seconds Security Edition
• RSA2013: Partner Spotlight – Websense
• RSA2013: Partner Spotlight – Quarri
• RSA2013: F5 RSA Security Trends Survey
• RSA2013: BIG-IP SSL/TLS Services
• F5′s YouTube Channel
• In 5 Minutes or Less Series (23 videos – over 2 hours of In 5 Fun)
• Inside Look Series
• Life@F5
• Also this week, check out: Mobile World Congress – Day 1 & Mobile World Congress – Day 2

Technorati Tags: f5,rsac,rsa,rsa2013,psilva,video,dns, dnssec,ddos

Inside Look - BIG-IP Advanced Firewall Manager

If you enjoyed In 5 Minutes or Less: BIG-IP Advanced Firewall Manager, this is a much deeper dive into the BIG-IP AFM solution.  I introduce BIG-IP Advanced Firewall Manager (AFM) and have Josh Mendosa, Product Management Engineer, show a demo of BIG-IP AFM available with BIG-IP v11.3. 

 

ps

Related:

• SAML Federation with BIG-IP Access Policy Manager: Inside Look – Video
• Inside Look - BIG-IP Advanced Firewall Manager
• Solving Substantiation with SAML – White Paper
• BIG-IP Advanced Firewall Manager Datasheet
• BIG-IP Advanced Firewall Manager Product Page
• BIG-IP Access Policy Manager Overview (pdf)
• F5 Enhances Application Delivery Security with the World’s Fastest Firewall
• F5's YouTube Channel
• In 5 Minutes or Less Series (23 videos – over 2 hours of In 5 Fun)
• Inside Look Series
• Life@F5

Technorati Tags: f5,big-ip,afm,advanced firewall,in 5,video,silva,security,dos,ddos,v11.3

Connect with Peter:	Connect with F5: