Institute for Development and Research in Banking Technology A Project Report on USING DNS TO PROTECT CLIENTS FROM MALICIOUS DOMAINS Submitted by M.L.V.L Akhil Vishnu 3rd year B.Tech, Computer Science and Engineering Indian Institute of Technology (ISM) Dhanbad. Guide Dr. V. Radha Assistant professor IDRBT, Hyderabad. 1 | P a g e ACKNOWLEDGEMENT I would like to express my gratitude to the Institute for Development and Research in Banking Technology (IDRBT) under the guidance of Dr. V. Radha, Assistant Professor, IDRBT, Hyderabad. I would not hesitate to add that this short stint in IDRBT has added a different facet to my life as this is a unique organization being a combination of academics, research, technology, communication service, crucial application etc. and at the same time performing roles as an arm of regulation, spread of technology, and facilitator for implementing technology in banking and non-banking system. I am extremely grateful to Dr. V.Radha for her advice, innovative suggestions and supervision. I thank her for introducing me to different aspects of “CYBER SECURITY AND DOMAIN NAME SYSTEMS”. I am thankful for IDRBT for providing such an amazing platform to work on real application oriented research. I would like to give special thanks to Mrs. Varsha Srivastava, Administrative Executive, IDRBT, Hyderabad for providing resource and motivation in carrying out this project. Finally, I thank one and all who made this project successful either directly or indirectly. M.L.V.L Akhil Vishnu 3rd year B.Tech, Computer Science and Engineering, Indian Institute of Technology (ISM) Dhanbad. 2 | P a g e CERTIFICATE This is to certify that Mr. M.L.V.L Akhil Vishnu, pursuing B.Tech Computer Science and Engineering at Indian Institute of Technology (ISM), Dhanbad, has undertaken a project as a summer internship at the Institute for Development and Research in Banking Technology (IDRBT), Hyderabad May 12, 2017 to July 7, 2017. He was assigned the project entitled “Using DNS to protect clients from malicious domains” under my guidance. During his course of project, he analysed the challenges faced by the clients in phishing and has implemented a solution. He has done excellent work with sincerity. I wish him all the best for all his endeavours. Dr. V Radha Assistant Professor IDRBT, Hyderabad. Place: Hyderabad Date: 7th July, 2017 3 | P a g e ABSTRACT DNS is a protocol within the set of standards for how computers exchange data on internet, known as IP/TCP protocol suite. A DNS server, also called as name server handles a massive database, which maps domain names to IP addresses. Phishing is the attempt to obtain confidential information such as usernames, passwords and details of credit and debit cards, often for malicious reasons, by tricking the user. There are some approaches to prevent phishing. DNS sinkhole is one among them. DNS sinkhole, also called as black hole DNS, is used to spoof DNS servers to prevent resolving hostnames of specified URLs. A sinkhole is a way of redirecting malicious internet traffic so that it can be captured and analysed by security analysts. This can be achieved by configuring the DNS forwarder to return a false IP address to a particular URL. This can be used to restrict access to specific sites that violate corporate policies, including social networking, abusive content etc. In DNS sinkhole, we create two lists called white list and black list. Malicious URLs can be collected from already known C&C servers, through the open source sites that are providing malicious IP details, malware analysis process etc. The known malicious URLs will be placed in blacklist whereas the white list contains known important URLs. The URLs present in black list can never be accessed. A URL present in white list can never be added to black list. The URLs present in white list are safe for sure. Thus the DNS sinkhole verifies the input DNS query with the elements present in white list. If a match is found, IP of that URL will be returned. Else, it verifies with those present in the blacklist. If a match is found then, the user will be redirected and a customised webpage can be shown. This webpage can be created with information detailing the corporate policy restriction and can be hosted on a local server. 4 | P a g e INDEX 1. Introduction……………………………………………………6 2. Problem Statement…………………………………………….7 3. DNS sinkhole overview……………………………………….7 3.1 DNS sinkhole workflow 3.2 DNS sinkhole setup overview 4. Installation, configuration and partitioning the drive………….10 4.1 DNS sinkhole server installation 4.2 Suggested drive configuration 4.3 Install the software 4.4 Sinkhole Configuration 5. DNS sinkhole web interface…………………………………..20 5.1 Configuring local sinkhole addresses 5.2 Populating the site exclusion list 5.3 Manually adding new sites to sinkhole 5.4 Search domains 6. Remote access…………………………………………………22 7. DNS sinkhole configuration…………………………………...23 7.1 Controlling access to suspicious sites 7.2 Changing MySQL root password 7.3 Configuring PowerDNS as sinkhole 7.4 PowerDNS monitoring webserver 8. Populating sinkhole using sinkhole_parser.sh…………………25 9. PowerDNS database……………………………………………27 10. Bibliography…………………………………………………..28 5 | P a g e 1. Introduction: The domain name system is indisputably one of the most important and overlooked parts of the internet. Since it is difficult to memorize large number of IP addresses, which are strings of numbers, DNS came into existence. Domain name system (DNS) manages a huge database mapping IP addresses against domain names. DNS takes the URLs we enter in our web browsers as input, finds the IP addresses of the web servers hosting those sites and returns those IP addresses. Phishing is a cybercrime in which a target or targets are attacked to acquire their confidential and sensitive information such as usernames, passwords, credit card details etc. During phishing, the user is tricked by the attacker to submit his/her confidential information into a fraudulent website. Phishing, therefore causes loss to user. DNS sinkhole is one of the many approaches for the sinkhole problem. DNS sinkhole contains blacklist and whitelist. Most of the techniques for phishing detection are based on blacklist. Blacklist is a file that contains a large number of known fraudulent sites. There are many ways like malware analysis, open source sites providing malicious IP details etc. to find fraudulent sites. Whitelist contains the known safe websites. When a user requests the DNS sinkhole to resolve IP address of a domain present in whitelist, its actual IP is returned. When a user requests a DNS server to resolve IP address of a malicious or fraudulent domain present in blacklist of the sinkhole, the user would be redirected to an internal website indicating that the site is blocked in accordance with corporate policy. In DNS sinkhole, we can also add domains manually into whitelist and blacklist and also remove them. When a new domain is added to the blacklist, the domain completely falls under the control of the sinkhole administrator. After this, it is no longer possible to access the original host. The blacklists must be updated constantly by the administrators of DNS sinkhole. Open source lists of known adware sites, malware sites and information from other sources can be combined with organisation specific information from DNS resource record queries from effected clients, analysis of malware found on compromised clients etc. The mentioned information can be added to the blacklist of sinkhole. The DNS sinkhole can also be used to take control of some domains which are not malicious or fraudulent but contravene the policies. Thus DNS sinkhole can be a part of security. 6 | P a g e 2. Problem Statement: It is the age of bots. Botnet traffic is increasing day by day, exploiting computer systems through a variety of infection vectors and establishing command and control channels for sale or lease to the highest bidder. Attacks are commonly seen in the form of cybercrime, and other illegal activities. Security analysts and administrators must respond daily to malware that forces a user to unknowingly download suspicious files from websites that they have no reason to access. Known applications that are dangerous must also be blocked. The following figure shows that botnet activity has been increasing day by day. Thus, it is the duty of security analysts and anti-malware engineers to control and prevent bots and other unwanted traffic. This is where DNS sinkhole can play a major role in preventing access to known malware sites as a part of security. 3. DNS Sinkhole overview: DNS sinkhole is simple and hence it is effective at detecting and blocking malware domains and unwanted traffic that try to reach internet. It has the capability to mitigate many types of threats that use DNS resolution. Administrators can add hosts and domains using DNS zone files. There are professionals who maintain lists of known unwanted and malicious domains and this information can used in the sinkhole. DNS sinkhole is inexpensive as it is an open-source software. The DNS sinkhole server works by impersonating an authoritative DNS server for unwanted and malicious domains and it returns a private address for such host and domain queries. The list of unwanted and malicious domains must be provided to the DNS sinkhole to make it effective. There are many advantages of deploying an internal DNS sinkhole. A sinkhole is scalable, effective, 7 | P a g e inexpensive and easy to maintain. Organisations can easily integrate their own ‘closed-source’ sinkhole entries for hosts or domains. This ability to customize data is a significant differentiator from commercial offerings. DNS sinkholes can not only block domains but also can block entire top level domains.