Infoblox Inc. All Rights Reserved. Securing the critical service - DNS

Transcription

1 Infoblox Inc. All Rights Reserved. Securing the critical service - DNS Rainer Singer, SE Manager CEUR, Infoblox October, 2014

2 Advanced DNS Protection Infoblox Inc. All Rights Reserved.

3 2013 DNS Threat is Significant Attacks against DNS infrastructure growing DNS-specific attacks up 200% in 2012 ICMP, SYN, UDP attacks growing significantly, too DNS is #2 attack vector protocol HTTP 87% DNS 67% SMTP 25% HTTPS 24% SIP/VOIP 19% IRC 11% Other 7% 0% 20% 40% 60% 80% 100% Source: Arbor Networks Infrastructure Layer: 76.52% ACK: 1.69% CHARGEN: 3.37% FIN PUSH: 0.39% DNS: 8.94% ICMP: 11.41% RESET: 1.94% RIP: 0.13% RP: 0.39% SYN: 18.16% SYN PUSH: 0.13% TCP FRAGMENT: 0.65% UDP FLOODS: 14.66% UDP FRAGMENT: 14.66% Source: Prolexic Quarterly Global DDoS Attack Report Q Infoblox Inc. All Rights Reserved.

4 The Solution - Infoblox Advanced DNS Protection Unique Detection and Mitigation Intelligently distinguishes legitimate DNS traffic from attack traffic like DDoS, DNS exploits, tunneling Mitigates attacks by dropping malicious traffic and responding to legitimate DNS requests Centralized Visibility Centralized view of all attacks happening across the network through detailed reports Intelligence needed to take action Ongoing Protection Against Evolving Threats Regular automatic threat-rule updates based on threat analysis and research Helps mitigate attacks sooner vs. waiting for patch updates Infoblox Inc. All Rights Reserved.

5 Security Built-in to the DNS Infrastructure Use Cases Internet Enterprise Customers External authoritative DNS server Security Protection against all DNS threats Internal DNS Enterprises / Universities with open networks DNS Server Standard Appliances DNS Server Advanced Appliances Serve DNS queries under attack Service Providers Recursive Caching Authoritative DNS services Traditional security appliances mitigate only partial attacks against DNS Infoblox Inc. All Rights Reserved.

6 DNS Protection is Not Just About DDoS DNS reflection/drdos attacks DNS amplification TCP/UDP/ICMP floods DNS-based exploits DNS cache poisoning Protocol anomalies Reconnaissance DNS tunneling DNS hijacking NXDomain attack Phantom domain attack Using third-party DNS servers (mostly open resolvers) to propagate a DoS or DDoS attack Using a specially crafted query to create an amplified response to flood the victim with traffic Denial of service on layer 3 or 4 by bringing a network or service down by flooding it with large amounts of traffic Attacks that exploit bugs or vulnerabilities in the DNS software Corruption of DNS server cache data with a rogue domain or IP Causing the server to crash by sending malformed DNS packets and queries Attempts by hackers to get information on the network environment before launching a DDoS or other type of attack Tunneling of another protocol through DNS port 53 for malware insertion and/or data exfiltration Modifying the DNS record settings to point to a rogue DNS server or domain Attacks that flood DNS server with requests for non-existent domains, causing it to send NXDomain (non-existent domain) responses Attacks where a DNS resolver is forced to resolve multiple non-existent domains, causing it to consume resources while waiting for responses DNS-specific Exploits Volumetric/DDoS Attacks Infoblox Inc. All Rights Reserved.

7 Centralized Visibility: Reporting Intelligence Needed to Take Action Attack details by category, member, rule, severity, and time Visibility into source of attacks for blocking, to understand scope and severity Early identification and isolation of issues for corrective action Infoblox Inc. All Rights Reserved.

8 Got Secure DNS? Infoblox Advanced DNS Protection Load Balancers Pure DDoS Next-gen Firewalls IPS Cloud Dedicated compute for threat mitigation General DDoS DNS DDoS DNS amplification DNS reflection DNS server OS and application vulnerabilities DNS semantic attacks Cache poisoning DNS tunneling DNS hijacking Volumetric/DDoS Attacks DNS-specific Exploits Infoblox Inc. All Rights Reserved.

9 DNS Firewall + FireEye Adapter Infoblox Inc. All Rights Reserved.

10 Malware/APT Trends 100% of companies are calling malicious malware hosts* Point solutions fail because malware is sophisticated Multiprotocol Multiple connections Encrypted, which means deep-packet inspection is ineffective * Source: Cisco 2014 Annual Security Report Infoblox Inc. All Rights Reserved.

11 Conventional DNS - Security Gap in your network Web Video Data Chat VoIP Malicious domain look-up Security infrastructure (Firewall, IPS/IDS, web gateway)! Conventional DNS Malware depends on DNS Protocol to find home Most often domain name is the only information available to identify malicious activity Infoblox Inc. All Rights Reserved.

12 How does the DNS Firewall work? Redirect 4 Infected Client Landing Page / Walled Garden Malicious link to Contact botnet Infoblox DNS Firewall / Recursive DNS Server 2 Dynamic Grid-Wide Policy Distribution Apply Policy Block / Disallow session 1 Dynamic Policy Update Infoblox DNS Firewall / Recursive DNS Server Malware Data Feed from Infoblox Infoblox DNS Firewall / Recursive DNS Server 6 Write to Syslog and send to Trinzic Reporting Infoblox Inc. All Rights Reserved. 12

13 DNS Firewall - FireEye Adapter Rogue Portals 1 C & C / Proxy Portal IP s FireEye Compromised Web Server or Domain DNS Server W/ DNS Firewall INTERNET INTRANET Block / Re-direct DNS Query Play Malware Attack Detects & detonates advanced malware Infoblox Reporting Server ID infected device by IP, MAC address & device type for remediation Infected Enterprise End-point Malware / apps Initiate DNS requests for web domains Infoblox Inc. All Rights Reserved.

14 DNS Firewall vs. other DDI vendors Web Video Data Malicious domain Look-up Security infrastructure (Firewall, IPS/IDS, Web Gateway) Chat VoIP Complete solution vs. feature Pinpoint device by IP / MAC / Type Malware Data Feed Service Integrated reporting & IPAM vs. DIY log searches/correlation DNS-specific/expert-generated reputational feed vs. DIY ( Go fish! ) Infoblox Inc. All Rights Reserved.

15 Span Port DNS Firewall Virtual Evaluation New! Use DNS to Find Malware/APT Hiding in Your Network Internet Caching DNS DNS FW Switch RPZ Hits Query Response Reporting Internal Network Shows malware activity No hardware (100% virtual) Non-disruptive to production network Fully automated with simple install 60-day trial Infoblox Inc. All Rights Reserved.

16 Thank You Visit us! Hall/Booth Infoblox Inc. All Rights Reserved.