DNS Abuse Techniques Matrix~Matrix Introduction and Usage~

JPCERT Coordination Center
Incident Response Group
Shoko Nakai

What is DNS?
DNS stands for Domain Name System; a systemdeveloped to manage and operate domain names on
the Internet.
It is the most indispensable system for using the Internet.
Just as an address to send a letter by mail, it is necessary to
identify where the recipient is.

The DNS is used as an easy-to-remember Internet address.

（ Reference : JPNIC https://www.nic.ad.jp/ja/basics/beginners/dns.html)

1© 2023 JPCERT/CC

How DNS is used
When browsing websites
https://www.jpcert.or.jp/

Complex$ host www.jpcert.or.jp
www.jpcert.or.jp is an alias for d81drv6iivfiw.cloudfront.net.
d81drv6iivfiw.cloudfront.net has address 13.32.50.120d81drv6iivfiw.cloudfront.net has address 13.32.50.45
d81drv6iivfiw.cloudfront.net has address 13.32.50.11
d81drv6iivfiw.cloudfront.net has address 13.32.50.72

When sending e-mail
TO: info@jpcert.or.jp

Received at one of the following mail servers

jpcert.or.jp. 300 IN MX 20 mx02.jpcert.or.jp. (210.148.223.19)
jpcert.or.jp. 300 IN MX 10 mx01.jpcert.or.jp. (210.148.223.3)
2© 2023 JPCERT/CC

How DNS is used
How DNS is used by attacker
Running for Phishing sites
Distribution of spam e-mails
Means of directing users to malware-infected sites
Malware's means of communication
Tools for DoS and DDoS attacks

3© 2023 JPCERT/CC

Difficulties when responding to DNS-related incidents

Individuals have different levels of accumulated
knowledge and expertise in DNS Abuse.
Few opportunities to share DNS Abuse expertise.

Miscommunication during response.
Differences in thinking about DNS abuse whencollaborating with overseas operators.

4© 2023 JPCERT/CC

Motivation for DNS Abuse Handling Documentation

If Japan doesn't have a document to refer to when dealing with DNS
Abuse, then create one!
Let's document and preserve the know-how exchanged between thelimited experts and businesses involved.
Let's follow the trend of DNS Abuse being discussed overseas andcreate an opportunity to start discussions and activities in Japan as
well!

5

© 2023 JPCERT/CC

Global Trends Related to DNS Abuse

2023

2019/10
Launch of DNS Abuse
Framework
DNS Abuse Institute(date unknown)

6© 2023 JPCERT/CC

2021/03
Document
Release2020/05
2) I&JPN“Toolkit DNS
Document
Level Action
Releaseto Address
1) DNS Abuse Abuse”
Framework
3) SSAC“Framework to “SAC115”
Address
Abuse”

2022/01
Document
Release4) European
Commission“Study on
Domain Name
SystemAbuse”

(1) Documents
Title.

Framework to Address Abuse

Organization DNS Abuse Framework

Summary7© 2023 JPCERT/CC

 6 pages
 DNS Abuse Explained in Five Categories
 Malware, Botnets, Phishing, Pharming, Spam (Spam isfor Phishing Email distribution)
 Views on the website content (if it has a negative impact onhuman life, take action)
 Explanation of response flow for website content
 Describes the role of trusted notifiers in the registry andregistrar

(2) Documents
Title.
Organization

Summary8© 2023 JPCERT/CC

Toolkit DNS Level Action to Address Abuse
INTERNET & JURISDICTION POLICY NETWORK (I&JPN)
 48 pages.
 Introduction divided into General Level and Technical Level
 General Level
 Identification and communication of fraudulent content
 Explanation of the evaluation of DNS-level responses in line with fraudulent content
and the impact of such responses (LOCK, HOLD, REDIRECT, TRANSFER).
 Technical Level
 Confirmation of the source of the report, evaluation of the content of the report, andexplanation of the evaluation of the request
 Explanation of the method for evaluating and determining the response process within
the business Mapping of DNS level support per DNS Abuse DNS Abuse Workflow

(3) Documents
Title.

(SAC115) SSAC Report on an Interoperable
Approach to Addressing Abuse Handling in the
DNS

Organization

ICANN Security and Stability Advisory Committee (SSAC)

Summary9© 2023 JPCERT/CC

 39 pages.
 Definition of DNS Abuse and Website Content
 See The Framework to Address Abuse Appropriate timing, response flow, and escalation in abuse response About Evidence of Abuse Website screenshot (phishing, etc.)
 MX records/ A, AAAA DNS records
 Malware behavior (botnets, ransomware, etc.)
 DNS Abuse Contact Information
 Appendix: (DNS ecosystem, supported operators, related organization groups)

(4) Documents
Title.

Organization

Summary10© 2023 JPCERT/CC

Study on Domain Name System (DNS) abuse
European Commission
 173 pages
 Domain space market, DNS ecosystem overview
 Definition of DNS Abuse
Focus on the following three areas as Abuse
1. Incidents with fraudulently registered domains
2. Events in DNS operation
3. Events related to website content (including unauthorized registration and infringing
domains)
 DNS Abuse Damage (summary including hearings)
 The Impact of IoT and 5G on DNS Abuse Regulatory Framework for DNS Abuse World Level (EU, ICANN, etc.)
 Community (I&JPN, DNS Abuse Framework, etc.)
 Examples of measures in TLDs (gTLDs, ccTLDs)
 Summary of Solutions for DNS AbuseSteps to Completion
Scrutiny of overseas documents.

Translate into Japanese.
Japanese-language documents are checked within
DNS operators and related parties.

Document Completed.
Completion and publication of a Japanese version DNS Abuse Techniques Matrix.
11© 2023 JPCERT/CC

Today's presentation

12

1

What is the Japanese version DNS Abuse Techniques
Matrix?

2Document Structure3

How to see the Matrix

4

Case Study

5

Concerns© 2023 JPCERT/CC

Today's presentation

13

1

What is the Japanese version DNS Abuse Techniques
Matrix?

2Document Structure3

How to see the Matrix

4

Case Study

5

Concerns© 2023 JPCERT/CC

What is the Japanese version DNS Abuse Techniques Matrix?

Japanese translation of the document "DNS Abuse
Techniques Matrix" published by the FIRST DNS Abuse
SIG in 2023.

2019/10
Launch of DNS Abuse
Framework
DNS Abuse Institute(Inception dateunknown)14© 2023 JPCERT/CC

2020/05
Document
Release1) DNS Abuse
Framework"Framework to
Address
Abuse”

2021/03
Document
Release2) I&JPN“Toolkit DNS
Level Action to
Address
Abuse”
3) SSAC“SAC115”2022/01
Document
Release4) European
Commission“Study on
Domain Name
SystemAbuse”

2023
Documentation
releasedFIRST
DNS AbuseSIG
DNS AbuseTechniques
MatrixFeatures
While previous DNS abuse-related documents are oftengrouped together under the general categories of phishing,
DDoS, etc., the actual factors and areas that need to beaddressed are much more detailed.
General categories classified by incident— phishing— defacement— DDoS— spam (unsolicited email messages)15© 2023 JPCERT/CC

Features
For example, phishing
Phishing is the act of using a real organization to fraudulently obtain
personal information such as usernames, passwords, etc.
（ Reference : Council of Anti-Phishing Japan https://www.antiphishing.jp/consumer/abt_phishing.html)

Many techniques are involved to carry out the phishing activities andacquire their objectives.
Possible methods/techniques— Registration of malicious domains— Registration of malicious subdomains— Web server and content preparation— Inducement by rewriting DNS information— Prepare domain for phishing e-mails— Sending spoofed e-mails16© 2023 JPCERT/CC

What is the Features of DNS Abuse Techniques Matrix?

Focusing on techniques rather than categories.
• Provide advice to incident response teams responding to incidents
involving DNS abuse.
• Aim to complement existing efforts in DNS abuse investigation
and research.

17© 2023 JPCERT/CC

not covered (by)Other techniques used in parallel with attacks involving the
DNS.
• BGP Hijacking• Things like TLS certificate spoofing

Scope related to the abuse of the DNS by malware.
• It does not cover, for example, dealing with malware used to generate DGA
domains.

18© 2023 JPCERT/CC

Today's presentation

19

1

What is the Japanese version DNS Abuse Techniques
Matrix?

2Document Structure3

How to see the Matrix

4

Case Study

5

Concerns© 2023 JPCERT/CC

Document Structure
22 pages (a volume that can be easily read)

Explanation of Terms— Stakeholders— Techniques— Actionsdetectmitigateprevent

Examples of Techniques
Abuse Matrix
20© 2023 JPCERT/CC

Explanation of Terms
Stakeholders• 15 related businesses, organizations, andpeople• Description of each stakeholder is provided.

Techniques• 21 different techniques• Description of each technique is provided.
Listed in 3 patterns of actions for each phase

Actions

21© 2023 JPCERT/CC• Detect• Mitigate• PreventExplanation of Terms: Stakeholders
15 related businesses, organizations, and people

22

Registrars

Registries

Authoritative Operators

Domain name resellers

Recursive Operators

Network Operators

Application Service Provider

Hosting Provider

Threat Intelligence Provider

Device, OS, & Application
Software Developers

Domain Registrants

End UserLaw Enforcement and Public
Safety Authorities

CSIRTs / ISACs

Incident Responder© 2023 JPCERT/CC

Description of stakeholders (partial introduction)
Registrars - an organization that allows registration of domains under a TLD https://www.icann.org/en/icann-acronyms-and-terms/registrar-en for more information.
Registries - organizations responsible for maintaining the database of domains for a TLDhttps://www.icann.org/en/icann-acronyms-and-terms/registry-en for more information.

Network Operator - Organizations operating an autonomous system (AS). We assume anorganization with this capability is not running a recursive DNS server. This column means NetFlow
and BGP data and excludes (as a matter of a clarity choice here) passive DNS.
Hosting Provider - https://en.wikipedia.org/wiki/Web_hosting_service. If the hosting provider is abulletproof hosting provider or otherwise complicit in providing attack infrastructure, then at best
there is no good that will come from contacting them and at worst it will expose the team to reprisals.

23© 2023 JPCERT/CC

Explanation of Terms: Techniques
21 different techniques
DGAs (Domain
Generation Algorithms)

Domain namecompromise

Lame delegations

DNS cache poisoning

DNS rebinding

DNS server compromise

Stub resolver hijacking

Local recursive resolver
hijackingOn-path DNS attack

DoS against the DNS

NS as a vector for DoS

Dynamic DNS resolution(as obfuscation
technique)Dynamic DNS resolution:
Fast flux (as obfuscation
technique)

Infiltration andexfiltration via the DNS

Malicious registration of(effective) second leveldomains

Creation of malicious
subdomains underdynamic DNS providers

Compromise of a nonDNS server to conduct
abuse

Spoofing or otherwise
using unregistereddomain names

Spoofing of a registereddomain

DNS tunneling

DNS beacon24© 2023 JPCERT/CC

Description of Techniques (partial introduction)
DGA (Domain Generation Algorithm) - See https://attack.mitre.org/techniques/T1568/002/ for more
information.
Domain name compromise- The wrongfully taking control of a domain name from the rightful nameholder. Compromised domains can be used for different kinds of malicious activity like sending
spam or phishing, for distributing malware or as botnet command and control.For more information,
see https://www.icann.org/groups/ssac/documents/sac-007-en.
Lame delegations - Lame delegations occur as a result of expired nameserver domains allowing
attackers to take control of the domain resolution by re-registering this expired nameserver domain.
See https://blog.apnic.net/2021/03/16/the-prevalence-persistence-perils-of-lame-nameservers/ formore information.
DNS cache poisoning -also known as DNS spoofing, is a type of cyber attack in which an attacker
corrupts a DNS resolver‘s cache by injecting false DNS records, causing the resolver to records
controlled by the attacker. For more information, see
https://capec.mitre.org/data/definitions/142.html.
25© 2023 JPCERT/CC

Explanation of Terms: Actions
Describes three patterns of conduct for each phaseprevent• using DNS-specific steps, make itless likely incidents of this type will
occur in the future.
• Knowledge transfer (including tointernal IT teams); Vulnerability
Response;

detect• Identify possible incident events• Monitoring and detection, receipt ofincident reports

mitigate• Contain the incident and restore safe
operations• Mitigation and Recovery

26© 2023 JPCERT/CCExamples of Techniques
JPCERT/CC
JPCERT/CC has published a list of phishing URLs that demonstrate examples oftechniques including domain generation algorithms (DGAs) and malicious
registrations of effective SLDs.
Phishing URL dataset from JPCERT/CC

U.S. Internal Revenue Service (IRS)The IRS published a warning against SMS scams making use of malicious
registration as well as spoofing the target organization.
IRS reports significant increase in texting scams; warns taxpayers to remain vigilant
NominetNominet published an explanation of how dangling DNS entries can lead tovulnerability to the lame delegation and on-path DNS attack techniques.
Dangling DNS is no laughing matter27© 2023 JPCERT/CC

Today's presentation

28

1

What is the Japanese version DNS Abuse Techniques
Matrix?

2Document Structure3

How to see the Matrix

4

Case Study

5

Concerns© 2023 JPCERT/CC

How to see the Matrix
techniquestakeholders
Registrars

DGAs (Domain
Generation
Algorithms)

Registries

Authoritative
Operators(eSLDs only, w/
analysis at point ofcreation and during the
lifetime of the domains)

Domain namecompromise
lacks the capability: The entity has the capability to: The entity lacks the capability to29© 2023 JPCERT/CC

Domain nameresellersRecursive
Operators

Matrix: Detection30© 2023 JPCERT/CC

Matrix: Mitigation31© 2023 JPCERT/CC

Matrix: Prevention32© 2023 JPCERT/CC

Today's presentation

33

1

What is the Japanese version DNS Abuse Techniques
Matrix?

2Document Structure3

How to see the Matrix

4

Case Study

5

Concerns© 2023 JPCERT/CC

How to Use the Matrix
Phishing

Phishing e-mailRunning Phishing sites
Prepare for phishing activities34© 2023 JPCERT/CC

Phishing e-mailPhishing e-mail impersonating Five Points Capital.
Target domain name
(Correct) fivepointscapital.com(False) fivepointscapital.org
Phishing e-mail Headers
Received: from 223404411203 named unknown by gmailapi.google.com with
HTTPREST; Fri, 4 Mar 2022 07:24:49 -0800
From: Whit Edwards <wedwards@fivepointscapital.org>
Date: Fri, 4 Mar 2022 07:24:49 -0800
Message-ID:<CALYXdvkVcj3ttxy34VqKEgz_tmwEExjdLB1smvTjopMbU2zwaQ@mail.gm
ail.com>
Subject: FIVE POINTS CAPITAL
To: <xxxxxx@shoreview.com>
passive DNS information;; bailiwick: fivepointscapital.org.
;; count: 1;; first seen: 2022-03-04 15:11:31 -0000;; last seen: 2022-03-04 15:11:31 -0000
fivepointscapital.org. in MX 1 aspmx.l.google.com.

35© 2023 JPCERT/CC

Phishing e-mailTechnique: Spoofing of a registered domain——

Header-From Spoofing
Spoofed domain that impersonates a legitimate domain

Detection

Mitigation

Prevention36© 2023 JPCERT/CC

Phishing site
https://kuronekohelp.com/information37© 2023 JPCERT/CC

https://japan-japan-aeon.shop/index.php

Phishing site
Technique: Malicious registration of (effective) second level domains
Detection

Mitigation

Prevention38© 2023 JPCERT/CC

Prepare for phishing activities
Prepare environment before starting phishing activity by tamperingwith DNS.
• Tampering with SPF authentication information in TXT records
Preparing to send a pretended authorized phishing e-mails;; bailiwick: *****.jp.
;; first seen: 2022-01-28 20:59:00 -0000;; last seen: 2022-01-28 20:59:00 -0000*****.jp. in TXT "v=spf1 ip4:133.242.52.116 ~all"*****.jp. in TXT "v=spf1 ip4:27.102.118.13/17 ~all"*****.jp. in TXT "v=spf1 a mx ptr a: ***** .jp ip4:27.102.118.0/24 ?all"• Add subdomain

Prepare phishing site for operation;; bailiwick: *****.jp.
;; count: 93;; first seen: 2022-01-23 12:38:07 -0000;; last seen: 2022-01-29 03:26:55 -0000
xserver-vps. *****.jp. in A 115.144.69.72
39© 2023 JPCERT/CC

Prepare for phishing activities
Technique: Domain name compromise
Detection

Mitigation

Prevention40© 2023 JPCERT/CC

How to Use the Matrix
Other
Lame Delegation
Water Torture attack against authoritative DNS servers

Cache poisoning by domain hijacking41© 2023 JPCERT/CC

Lame Delegation
Lame Delegation is a situation in which the DNS server registered in the upper zone at
the time of delegation is not working properly for that domain for some reason.
（ Reference : JPRS https://jprs.jp/tech/notice/2003-05-20-dnsqc-lame-delegation.html)

Domain Information: [Domain Information][Domain Name] ************.JP[Registrant's name] ********* Corporation[Registrant] **********[Name Server] ns-1926.awsdns-48.co.uk[Name Server] ns-309.awsdns-38.com[Name Server] ns-1008.awsdns-62.net[Name Server] ns-2000.awsdns-58.co.uk[Signing Key].

[Date of registration] 2016/11/15[Expiration date] 2023/11/30[Status] Active[Last Updated] 2022/12/01 01:05:08 (JST)$ dig @ns-309.awsdns-38.com ************.jp

mismatch;; AUTHORITY SECTION:.
************.jp. 172800 IN NS ns-1008.awsdns-62.net.
************.jp. 172800 IN NS ns-1268.awsdns-30.org.
************.jp. 172800 IN NS ns-2000.awsdns-58.co.uk.
************.jp. 172800 IN NS ns-309.awsdns-38.com.

$ dig @ns-1926.awsdns-48.co.uk ************.jp;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 24815;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0;; WARNING: recursion requested but not available;; QUESTION SECTION:.
; ************.jp. in A

ns-1926.awsdns-48.co.uk cannot resolve the name.
42© 2023 JPCERT/CC

Lame Delegation
Technique: Lame Delegation— Mainly addressed by Domain Registrants

Detection

Mitigation

Prevention

43© 2023 JPCERT/CC

Water Torture Attack against authoritative DNS servers

DNS Water Torture attack—Using Open Resolver to execute attacks.
— Target is jpcert.or.jp authoritative DNS server.
Water Torture attack targeted JPCERT/CC domain2023-07-08 21:46:53.570989 IP SourceOfAttack.39636 > Open Resolver.53: 19199+ A? amur.jpcert.or.jp. (35)2023-07-08 21:46:55.153998 IP SourceOfAttack.39636 > Open Resolver.53: 52204+ A? chickadee.jpcert.or.jp. (40)2023-07-08 21:47:00.651903 IP SourceOfAttack.39636 > Open Resolver.53: 9206+ A? cycle1.jpcert.or.jp. (37)2023-07-08 21:47:02.548646 IP SourceOfAttack.39636 > Open Resolver.53: 11887+ A? mosaffa.jpcert.or.jp. (38)2023-07-08 21:47:05.370698 IP SourceOfAttack.39636 > Open Resolver.53: 18118+ A? sokolova-nina.jpcert.or.jp. (44)44

© 2023 JPCERT/CC

Water Torture attack against authoritative DNS servers

Technique: DNS as a vector for DoS
Detection

Mitigation

Prevention45© 2023 JPCERT/CC

Cache poisoning by domain hijacking
A situation in which an attacker corrupts a DNS resolver's cache byinjecting false DNS records, causing the resolver to records controlled
by the attacker.
Normal condition

After hijack

whois :*********.com
Domain Name: *********.COM;; bailiwick: *********.com.
;; count: 1,686;; first seen: 2020-05-30 15:43:14 -0000;; last seen: 2020-06-01 16:04:04 -0000
coincheck.com. in NS ns-650.awsdns-017.net.
coincheck.com. in NS ns-1515.awsdns-061.org.
coincheck.com. in NS ns-1985.awsdns-056.co.uk.

Name Server: NS-1515.AWSDNS-61.ORG
Name Server: NS-1985.AWSDNS-56.CO.UK
Name Server: NS-405.AWSDNS-50.COM
Name Server: NS-650.AWSDNS-17.NET

NS-650.AWSDNS-17.NET
NS-1515.AWSDNS-61.ORG
NS-1985.AWSDNS-56.CO.UK
46© 2023 JPCERT/CC

ns-650.awsdns-017.net
ns-1515.awsdns-061.org.
ns-1985.awsdns-056.co.uk

Cache poisoning by domain hijacking
Technique: DNS Cache Poisoning
Detection

Mitigation

Prevention

47© 2023 JPCERT/CC

Today's presentation

48

1

What is the Japanese version DNS Abuse Techniques
Matrix?

2Document Structure3

How to see the Matrix

4

Case Study

5

Concerns© 2023 JPCERT/CC

Concerns
In some cases, the scope of stakeholder responsibility varies by country or
region.
Difficult to utilize this matrix under the provision of services by a business
operator with malicious intent.

Difficult to utilize this matrix when addressing policy-related events.

Countermeasures will be updated and the matrix will need to be updated as
well.
49

© 2023 JPCERT/CC

in the end
The DNS Abuse Techniques Matrix has been compiled
for incident responders and those investigating DNS
abuse.
As we investigate security incidents in depth, we are surethat many of them will involve the DNS, and we hope thatthe DNS Abuse Techniques Matrix will be of assistancein the investigation and in making adjustments.

50© 2023 JPCERT/CC

Contact info:
JPCERT Coordination Center— Email: pr@jpcert.or.jp— https://www.jpcert.or.jp/reference.html

incident reporting— Email: info@jpcert.or.jp— https://www.jpcert.or.jp/form/

Incident Response Group— Email: ir-info@jpcert.or.jp
Company names and product names mentioned in this document are trademarks or registered trademarks of their respective companies.

51© 2023 JPCERT/CC

Thank you for your attention.

52© 2023 JPCERT/CC

Reference Web site
JPCERT/CC— Matrix for Countering DNS Abuse Techniques— Phishing URL dataset from JPCERT/CC

FIRST DNS Abuse SIG— DNS Abuse Technique Matrix

Framework to Address Abuse— DNS Abuse Framework

ICANN— SAC115 (SSAC Report on an Interoperable Approach to Addressing
Abuse Handling in the DNS)INTERNET & JURISDICTION POLICY NETWORK— Toolkit DNS Level Action to Address

EU(European Union)— Study on Domain Name System (DNS) abuse

U.S. Internal Revenue Service (IRS)— IRS reports significant increase in texting scams; warns taxpayers to remain vigilant

Nominet— Dangling DNS is no laughing matter53© 2023 JPCERT/CC