Dark  Side  of  the  DNS  ForceERIK  WUACALVIO,  INC.  Intro
Subdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

DNS

104.20.66.243

IntroSubdomain
Mechanism
ImpactOutro

Good  BadUgly

DNS

blackhat.com.

DNS

104.20.66.243

104.20.66.243

IntroSubdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

Registered  Internet  Domains
Internet  Domain  Names  (in  millions)

1200
1000
800
600
400
200
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016

0Source  S tatista

IntroSubdomain
Mechanism
ImpactOutro

Good  BadUgly

FLASHING  IN  MARCH  2013
300gbps DNS  amplification  attacks
27.2M open  DNS  resolvers  (in  2013)  17.6M of  today  (>3yrs  later)
Source  openresolverproject.org  Cloudflare/Spamhaus  DDoSed  via  open  DNS  resolvers

Responses

UniqueCorrect  Responses

Wrong  PortRAIntro
Subdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

DNS  amplification  DDoS  attacks  • Enablers  • Open  DNS  resolvers  • DNS  amplifiers

DNS  Amplifier• Legit  • Purpose-­built  • Spoofed  sending  addresses  (of  victims)

OpenResolver

OpenResolver

attacker

victimIntroSubdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

DNS  amplification  DDoS  attacks  DNS  AMPLIFIER

Legit      |      Purpose-­built

IntroSubdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

DNS  amplification  DDoS  attacks  DNS  AMPLIFIER

Legit      |      Purpose-­built

IntroSubdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

DNS  amplification  DDoS  attacks  DNS  AMPLIFIER

Legit      |      Purpose-­builtIntro
Subdomain
Mechanism
ImpactOutro

Good  BadUgly

DNS  amplification  DDoS  attacks  DNS  AMPLIFIER

Legit      |      Purpose-­built

IntroSubdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

DNS  amplification  DDoS  attacks  • Mitigation  options• Filter  spoofed  sending  addresses• Disarm  amplifiers  • Close  open  resolvers

IntroSubdomain
Mechanism
ImpactOutro

Good  BadUgly

High  spikes  of  unique  domains  seen  on  Internet  Unique  Domain  Names  (in  Millions)

6000
5000
4000
3000
2000
10000Source:  NominumIntroSubdomain
Mechanism
ImpactOutro

Good  Bad
Ugly

What’s  wrong  with  subdomains?
blackhat.com.
www.blackhat.com.
m.blackhat.com.
media.blackhat.com.

104.20.66.243

wwww.blackhat.com.
mwww.blackhat.com.
mmww.blackhat.com.
mmmw.blackhat.com.
mmmm.blackhat.com.

NXDOMAIN

IntroSubdomain
Mechanism
ImpactOutro

Initial   Trial
Serious
weaponSubdomain  attack  as  a  competitive  edge

• Online  gaming  sites’  availability  is  a  key  metrics  • Subdomain  attack  was  a  novel  abuse  of  DNS  back  in  2011/2012  • Initially  simple  sequence  number  strings  were  used  as  prefixes  to  a  competitor  gaming  site  domain  name  to  destruct  the  service  of  that  gaming  site:

100000000.sf520.com.
100000001.sf520.com.
100000010.sf520.com.
100000011.sf520.com.
100000100.sf520.com.
100000101.sf520.com.
100000110.sf520.com.
100000111.sf520.com.
100001000.sf520.com.

IntroSubdomain
Mechanism
ImpactOutro

Initial   Trial
Serious
weaponAimed  at  high-­value  targets~200M  unique  subdomains  of  arkhamnetwork.org.

IntroSubdomain
Mechanism
ImpactOutro

Initial   TrialSerious
weaponAimed  at  high-­value  targets

IntroSubdomain
Mechanism
ImpactOutro

Strings
Position
Composition

Subdomain  strings  SUBDOMAIN  STRINGS:• Fixed  or  varying  length:  z5kr836ws                                   qjkn  zdecc7nnx  styzcphur• Time  stamps:

1465560729                             1465561210• Random  strings

WO423WWWOX5C

FN88RBHXWX9J• Random  numbers

2967230841

4343234574• Sequence   numbers

1165885261118

1165885261119• Dictionary  words

glassmaking

dishwater

IntroSubdomain
Mechanism
ImpactOutro

Strings
Position
Composition

Subdomain  position  SUBDOMAIN  POSITION:• Left  most  zdecc7nnx.www.blackhat.com.

• 2nd  left  most  m.zdecc7nnx.www.blackhat.com.

• 3rd  left  mostn.m.zdecc7nnx.www.blackhat.com.

• Any  position  on  the  left  side  of  target  domain

IntroSubdomain
Mechanism
ImpactOutro

Strings
Position
Composition

Subdomain  composition  SUBDOMAIN  COMPOSITION:• Single  subdomain  string• Multiple  subdomain  strings

FN88RBHXWX9J.blackhat.com.
WO423WW1WX5.FN88RBHXWX9J.blackhat.com.

• Combination  of  constant  and  random  strings

a.FN88RBHXWX9J.blackhat.com.
b.WO423WW1WX5.blackhat.com.

IntroSubdomain
Mechanism
ImpactOutroOperation
Mitigation

Impact  • Attacking  target  domain’s  authoritative  name  servers• Collateral  damages  of  DNS  resolvers  along  the  path
• Enablers:  • Subdomain  generator  • (optional)  Open  resolvers• (optional)  Spoofed  sending  addresses

Resolvervictim’s  name  server

Resolverwhat  is  IP  address  of  victim.com?
victim.com.

IntroSubdomain
Mechanism
ImpactOutroOperation
Mitigation

Operation  Disruption

Authoritative  name  server  often  serves  more  than  one  domain,  so  does  DNS  resolver  (cache/recursive)
A  major  ISP  operation  may  be  taken  down  by  small-­scale  subdomain  attacks•2gbps  vs  300gbps  Intro
Subdomain
Mechanism
ImpactOutroOperation
Mitigation

Mitigation  Option  • SUBDOMAIN  ATTACKS  MAY  BE  MITIGATED  WITH  VARYING  RESULTS:• Drop  queries  with  random  strings• Limit  queries  with  random  strings• Limit  queries  per  IP  address• Limit  queries  per  domain• Drop  queries  per  domain• What  about  high-­value  targets?  Intro
Subdomain
Mechanism
ImpactOutroInnovation
DefenseDark  Side  Innovation

SIMPLE  PROTOCOL  ABUSE  CAN  BECOME  A  MAJOR  SECURITY  HEADACHE  AND  COSTLY  MITIGATION:• DNS  cache  poisoning• DNS  changer  • DNS  amplification• DNS  subdomain  • DNS  tunnelingIntroSubdomain
Mechanism
ImpactOutroInnovation
DefenseDark  Side  Innovation

ARMS  RACE  BETWEEN  THE  DARK-­SIDE  INNOVATIONS  AND  OURS  IN  CYBER  SECURITY  DEFENSE:The  dark-­side  has  repeatedly  won  the  fightRethinking  of  ourdefense  strategy

Any  glitch in  our  defense  is  a  winning  amplifiable  opportunity for  the  dark-­side,  while  vice  versa  is  not  true

Deception to  help  rebalance  the  asymmetric  warfare  situation  between  the  dark-­side  and  usThanks  and  Questions