Evidence of DNS tunnelling in two-fifths of business networks

Tunnelling trend

The prevalence of DNS tunnelling is one of the trends that stands out in the quarter, the report said, noting that cyber criminals know that DNS is a well-established and trusted protocol, and that many organisations do not examine their DNS traffic for malicious activity.

DNS tunnelling enables cyber criminals to insert malware or pass stolen information into DNS queries, creating a covert communication channel that bypasses most firewalls, the report said.

While there are quasi-legitimate uses of DNS tunnelling, many instances are malicious. There are several off-the-shelf tunnelling toolkits readily available on the internet that enable cyber criminals with relatively little technical expertise to mount DNS tunnelling attacks.

Cocktail ingredient

According to Infoblox, DNS tunnelling is often an element in very sophisticated attacks, including those sponsored or directly managed by nation states. For example, the recently uncovered Project Sauron – a particularly advanced threat likely to have been sponsored by a government – uses DNS tunnelling for data exfiltration. 

“In the physical world, burglars will go to the back door when you’ve reinforced and locked the front door. When you then secure the back door, they’ll climb in through a window,” said Rod Rasmussen, vice president of cyber security at Infoblox.

“Cybersecurity is much the same. The widespread evidence of DNS tunnelling shows cyber criminals at all levels are fully aware of the opportunity. Organisations can’t be fully secure unless they have tools in place to discover and prevent DNS tunnelling.”

The specific security threats uncovered by Infoblox during the second quarter, ranked by percentage, include:

• Protocol anomalies – 48%
• DNS tunnelling – 40%
• Botnets – 35%
• Amplification and reflection traffic – 17%
• Distributed denial of service (DDoS) traffic – 14%
• Ransomware – 13%

“While these threats are serious, DNS can also be a powerful security enforcement point within the network,” Rasmussen pointed out.

“When suspicious DNS activity is detected, network administrators and security teams can use this information to quickly identify and remediate infected devices, and can use DNS firewalling as well to prevent malware inside the network from communicating with command-and-control servers,” he said.