Off Label Use of DNS - Is DNS Providing Domain Name Service Only?
Channel: FIRST
Date: 12/02/2021

DNS is known to be one of the most widely abused protocols by the threat actors to use in unconventional ways to hide under normal traffic. Apart from threat actors DNS is being actively used or rather misused by many other service providers, vendors etc. to provide the intended services. An in depth research of the DNS logs collected over a long period of time revealed some very interesting legit use-cases of DNS protocol by the industry, apart from its normal resolution service. We coined the term “Off label use of DNS” to represent those use-cases. One of the main reasons DNS is been used or rather misused for these off-label use-cases is the speed of data transfer and less overhead in terms of bandwidth. These off-label use cases of DNS leaks very important information about the clients and software they are running, and can be leveraged in variety of ways by the network security defenders/analysts to improve the detection on the network. This presentation will go over some of those legit off-label use-cases and how they can be leveraged by the analysts to detect malware trends in the network and much more just by analyzing DNS logs.
---

Chase Cotton (Ph.D. EE, UD, 1984; BS ME, UT Austin, 1975) is a successful researcher, carrier executive, product manager, consultant, and educator for the technologies used in Internet and data services in the carrier environment for over 30 years.

Beginning in the mid-80’s Dr. Cotton’s communications research in Bellcore’s Applied Research Area involved creating new algorithms and methods in bridging, multicast, many forms of packet-based applications including voice & video, traffic monitoring, transport protocols, custom VLSI for communications (protocol engines and Content Addressable Memories), and Gigabit networking. In the mid-90’s as the commercial Internet began to blossom, he transitioned to assist carriers worldwide as they started their Internet businesses including Internet Service Providers (ISPs), hosting and web services, and the first large scale commercial deployment of Digital Subscriber Line (DSL) for consumer broadband services.Â In 2000, Dr. Cotton assumed research, planning, and engineering for Sprint’s global Tier 1 Internet provider, SprintLink, expanding and evolving the network significantly during his 8 year tenure. At Sprint his activities include leading a team that enabled infrastructure for the first large scale collection and analysis of Tier 1 backbone traffic, and twice set the Internet 2 Land Speed World Record on a commercial production network.

Since 2008, Dr. Cotton has been at the University of Delaware in the Department of Electrical and Computer Engineering, initially as a visiting scholar, and later as a Senior Scientist, Professor of Practice, and Director of Delaware’s Center for Information and Communications Sciences (CICS). His research interests include cybersecurity and high-availability software systems with funding drawn from the NSF, ARL, CERDEC, JPMorgan Chase, and other industrial sponsors.Â He currently is involved in the educational launch of a multi-faceted Cybersecurity initiative at UD where he is developing new security courses and degree programs including a minor and MS in Cybersecurity.

Dr. Cotton currently consults on communications and Internet architectures for many carriers and equipment vendors worldwide.

Fatema is a Security Engineer at the University of Delaware, where her responsibilities include monitoring network traffic for intrusions, incident response, threat hunting, and deploying and managing SIEM for the University. She has held prior roles in security research and software engineering and she holds CISSP certification together with GCIA, GPEN, GCIH, GCDA GIAC certifications. Fatema has given multiple talks internationally at CERN Geneva’19, EDUCAUSE SPC’19, Internet2 TechEX’19, BSidesDE'16,17,18,19, RIMM'17, BroCon'17,18,19". She also is a member of SANS/GIAC Advisory Board.