Transcript Securing DNS Infrastructure Steven Barber | Principle Sales Engineer April 2014 1 | © 2013 2014 Infoblox Inc.

Securing DNS Infrastructure
Steven Barber | Principle Sales Engineer
April 2014
1 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Agenda
Infoblox Overview
DNS Security Challenges
Securing the DNS Platform
Defending Against DNS Attacks
Preventing Malware from using DNS
Securing DNS Infrastructure
2 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Infoblox Overview & Business Update
Total Revenue
Founded in 1999
(Fiscal Year Ending July 31)
Headquartered in Santa Clara, CA
with global operations in 25 countries
$250
Leader in technology
for network control
$200
($MM)
$225.0
$169.2
Market leadership
$150
$132.8
• Gartner “Strong Positive” rating
• 40%+ Market Share (DDI)
$102.2
$100
6,900+ customers, 64,000+
systems shipped
$56.0
$50
$61.7
$35.0
38 patents, 25 pending
IPO April 2012: NYSE BLOX
3 | © 2013
2014 Infoblox Inc. All Rights Reserved.
$0
FY2007
FY2008
FY2009
FY2010
FY2011
FY2012
FY2013
Infoblox : Technology for Network Control
VIRTUAL MACHINES
PRIVATE CLOUD
APPLICATIONS
NETWORK
INFRASTRUCTURE
CONTROL PLANE
APPS &
END-POINTS
END POINTS
Infrastructure
Security
Historical / Real-time
Reporting & Control
Infoblox GridTM w/ Real-time
Network Database
FIREWALLS
4 | © 2013
2014 Infoblox Inc. All Rights Reserved.
SWITCHES
ROUTERS
WEB PROXY
LOAD BALANCERS
Why is DNS an Ideal Target?
DNS is the
cornerstone of the
Internet used by
every business/
Government
DNS as a Protocol
is easy to exploit
Traditional
protection is
ineffective against
evolving threats
DNS outage = business downtime
5 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Today’s DNS Security Challenges
1
Securing the DNS Platform
2
Defending Against DNS Attacks
3
Preventing Malware from using DNS
6 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Securing DNS
Prevents Malware/APT from Using DNS
Defend Against DNS Attacks
Secure the DNS Platform
7 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Securing DNS
Prevents Malware/APT from Using DNS
Defend Against DNS Attacks
Secure the DNS Platform
8 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Hacks of DNS – 2013 & 2014
9 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Security Risks with Conventional Approach
DNS installed on off-the-shelf server
• Many open ports subject to attack
• Users have OS-level account
privileges on server
• No visibility into good vs. bad traffic
• Requires time-consuming manual
updates
• Requires multiple applications for
device management
10 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Multiple
Open Ports
Secure DNS Servers – Hardware / OS / Application
• Minimal attack surfaces
• Active / Active HA & DR recovery
• Fast/easy upgrades
• Detailed audit logging
• Centralized management with rolebased control (No Root Access)
• Encrypted Inter-appliance
Communication
• Secured Access, communication & API
11 | © 2013
2014 Infoblox Inc. All Rights Reserved.
DNSSEC - External DNS Security
DNS Root
Trust Chain
Automatically
Implement DNSSEC
to mitigate hijacking
threats such as the
Kaminsky attack
2nd Level Domain
nth Level Domain
Implementing DNSSEC…..
•
Central configuration of all DNSSEC parameters
•
Automated key refresh
•
Automated maintenance
•
Automatic maintenance of signed zones
12 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Cryptographically
signed DNS data
Securing DNS
Prevents Malware/APT from Using DNS
Defend Against DNS Attacks
Secure the DNS Platform
13 | © 2013
2014 Infoblox Inc. All Rights Reserved.
DNS Attacks up 216%
~ 10% of infrastructure attacks targeted DNS
ACK: 2.81%
ICMP: 9.71%
RESET: 1.4%
CHARGEN: 6.39%
RP: 0.26%
FIN PUSH: 1.28%
DNS: 9.58%
SYN: 14.56%
SYN PUSH: 0.38%
TCP FRAGMENT: 0.13%
UDP FRAGMENT: 17.11%
UDP FLOODS: 13.15%
Source: Prolexic Quarterly Global DDoS Attack Report Q4 2013
~ 80% of organizations surveyed experienced application layer attacks on DNS
HTTP
82%
DNS
77%
SMTP
25%
HTTPS
54%
SIP/VOIP
20%
IRC
6%
Other
9%
0%
14 | © 2013
2014 Infoblox Inc. All Rights Reserved.
20%
40%
60%
Survey Respondents
80%
100%
Source: Arbor Networks
Anatomy of an Attack
Distributed Reflection DoS Attack (DrDoS)
How the attack works
• Combines Reflection and Amplification
• Use third-party open resolvers in the
Internet (unwitting accomplice)
Internet
• Attacker sends small spoofed packets to
the open recursive servers, requesting a
large amount of data to be sent to the
victim’s IP address
• Uses multiple such open resolvers, often
thousands of servers
Attacker
• Queries specially crafted to result in a very
large response
• Causes DDoS on the victim’s server
Target Victim
15 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Legitimate Traffic
Protection against attacks
Automatic
updates
External DNS
Internal DNS
Data for
Reports
Cloud-based
Threat-rule
Update
Service
Reporting
Server
Reports on attack types, severity
16 | © 2013
2014 Infoblox Inc. All Rights Reserved.
DNS Protection is not Just About DDoS
DNS reflection/DrDoS attacks
Using third-party DNS servers(open resolvers) to propagate
a DOS or DDOS attack
DNS amplification
Using a specially crafted query to create an amplified
response to flood the victim with traffic
DNS-based exploits
Attacks that exploit vulnerabilities in the DNS software
TCP/UDP/ICMP floods
Denial of service on layer 3 by bringing a network or service
down by flooding it with large amounts of traffic
DNS cache poisoning
Corruption of the DNS cache data with a rogue address
Protocol anomalies
Reconnaissance
DNS tunneling
17 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Causing the server to crash by sending malformed packets
and queries
Attempts by hackers to get information on the network
environment before launching a DDoS or other type of attack
Tunneling of another protocol through DNS for data
exfiltration
Securing DNS
Prevents Malware/APT from Using DNS
Defend Against DNS Attacks
Secure the DNS Platform
19 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Anatomy of an Attack
Cryptolocker “Ransomware”
• Targets Windows-based computers
• Appears as an attachment to legitimate
looking email
• Upon infection, encrypts files: local hard
drive & mapped network drives
• Ransom: 72 hours to pay $300US
• Fail to pay and the encryption key is
deleted and data is gone forever
• Only way to stop (after executable has
started) is to block outbound connection to
encryption server
20 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Blocking Malware from using DNS
Malware
Data Feed Service
1
An infected device brought into
the office. Malware spreads to
other devices on network.
4
2
Malicious
domains
IPs, Domains, etc.
of Bad Servers
2
Malware makes a DNS query
to find “home.” (botnet / C&C).
DNS Server RPZ detects &
blocks DNS query to malicious
domain
Internet
DNS/DHCP/IPAM : Pinpoint
Malware /
APT
Intranet
3 Reporting /Syslogs should be
DNS Sever
with RPZ
able to cross correlate the
following:
Blocked attempt
sent to Syslog
•
•
•
•
1
3
IP address
MAC address
Host name
DHCP lease history
2
4
Malware / APT spreads
within network; Calls home
21 | © 2013
2014 Infoblox Inc. All Rights Reserved.
DNS server RPZ updated every
2 hours with blocking information
from reliable service
Blocking APT from using DNS
Malicious
Domains
1
Detect - FireEye detects APT,
alerts are sent to Infoblox.
Malware
Internet
2
2
Disrupt –DNS Server RPZ
with FireEye data disrupts
malware DNS communication
Intranet
Infoblox DDI
with DNS
Firewall
3
Alerts
1
Endpoint Attempting
To Download
Infected File
FireEye NX
Series
FireEye detonates and
detects malware
22 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Blocked attempt
sent to Syslog
3 DNS/DHCP/IPAM: Pinpoint
Reporting/Syslogs should
be able to cross correlate
the following:
•
•
•
•
IP address
MAC address
Host name
DHCP lease history
DNS RPZ Protects against…..
Fast Flux
APT / Malware
Rapidly changing of domains & IP addresses by malicious
domains to obfuscate identity and location
Malware designed to spread, morph and hide within IT
infrastructure to perpetrate a long term attack (FireEye)
DNS Hacking
Hacking DNS registry(s) & re-directing users to malicious
domain(s)
Geo-Blocking
Blocking access to geographies that have rates of malicious
domains or Economic Sanctions by US Government
23 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Summary
DNS is the cornerstone
of the Internet
Prevents Malware/APT from Using DNS
Unprotected DNS
infrastructure
introduces security
risks
Defend Against DNS Attacks
Secure the DNS Platform
Securing DNS protects
critical DNS services
24 | © 2013
2014 Infoblox Inc. All Rights Reserved.
Thank you!
For more information
www.infoblox.com
25 | © 2013
2014 Infoblox Inc. All Rights Reserved.