BIND’s New Security Feature: DNSRPZ - the "DNS Firewall"


Published on

Learn how to turn your network’s DNS into a Security Tool! Webinar-Oct 12th

What do you do if the security tools are not protecting your network? Cyber-criminals are constantly finding ways to bypass your security tools and own your network. When the threat changes, you should grow with the threat - think out of the box – using tools that the criminals have not yet considered; the DNS.

ISC’s Internet Critical Open Source DNS software BIND has a new feature that would turn a DNS Caching Resolver into a tool to help protect your network from malware. All the computers in your network must contact your DNS Resolvers to get to the outside world. Your DNS Resolvers are critical “choke-point” for which all devices in your network must interact to get to the outside world. This "choke-point" is a logical choice to put security capabilities to check if a domain is "clean" or "dirty."

How can you have your DNS Resolver check if a domain is clean or dirty? Use BIND’s new feature – the DNS Response Policy Zone (DNSRPZ). DNSRPZ uses secure and fast zone transfer technologies to pull down black list of bad domains and put them into your DNS resolver.

The archived recording of the Webinar is here:

Who should watch this Webinar?

E-mail Administrators: Find out how DNSRPZ offers more effective way to work with the Anti-Spam black list.

Network Operators: Learn how DNSRPZ can be used inside your network to keep your users from being in-inadvertently infected by malware, zero-days, and malvertisements.

Security Engineers: Discover how DNSRPZ is a tool to help contain infections that get into your network and try to “call home” to a BOTNET controller.

Hosting Providers: By default, most of your hosting customers are using your DNS resolvers. Learn how DNSRPZ can help prevent and contain the threat of your customers getting infected.

Service Providers: Learn how to turn your DNS services into a tool to help protect all your customers from infection.

Mobile Telecoms Operators: Find a new tool that would prevent miscreant smart phone applications from calling home with DNS and infecting your customer’s phones.

SCADA and Critical Industrial System Operators: Learn how DNSRPZ is a tool to help protect legacy control systems that need DNS to work.

BIND’s New Security Feature: DNSRPZ - the "DNS Firewall"

  1. 1. The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again. DNS Response Policy Zone (DNSRPZ) BIND’s New Security Feature: the "DNS Firewall" Barry Raveendran Greene & Vernon Schryver Version 1.1
  2. 2. Logistics•  This presentation can be downloaded from the Webinar recording and from ISC’s Knowledge Base:•  ISC updates, presentations, and materials can be followed on:   Facebook -   Twitter - ISCdotORG   Linkedin -   RSS via our Website
  3. 3. Our Goal – Take Back DNSDNS works as well for the bad guys(criminals, spammers, spies) as forrespectable citizens. The bad guys aretaking better advantage of DNSs resiliencyand distributed autonomy.Something has got to be done!ISC is acting: Act I – Massive Passive DNS Deployment Act II - DNSRPZ
  4. 4. Agenda•  The DNSRPZ Quick Talk•  Why do we need DNSRPZ?•  More Details•  DNSRPZ Providers
  5. 5. Gratitude•  Paul Vixie and Vernon Schryver for all the heavy lifting to make DNSRPZ happen.•  ISC’s BIND Engineering Team – for integrating this new feature so quickly.•  Eric Ziegast - my partner in explaining DNSRPZ to people.•  For the new DNSRPZ Providers:   Simon Forster   Arnie Bjorklund   Rod Rasmussen•  Johanna Mansor who helped put this together so quickly.
  6. 6. DNSRPZ Quick Talk
  7. 7. DNS Response Policy Zone (DNS RPZ)•  DNS RPZ is policy information inside a specially constructed DNS zone.•  This enables DNS reputation data producers and consumers to cooperate in the application of such policy to real time DNS responses.•  DNS RPZ turns the recursive DNS server into a security hammer …   Provide the same capabilities of an anti-spam DNSBL (DNS Block List, ne RBL) and RHSBL (Right Hand Side Block List)….   … with greater degrees of scaling and speed.
  8. 8. Core DNS Principles .root .org Master/ Who is in charge of Primary DNS AXFR TSIG TSIG IXFR is Caching Resolver Slave/ Secondary DNS DNS What is the IP for - Full Zone TransfersIXFR - Incremental Zone TransfersTSIG - Transaction SIGnatureused to secure the AXFR/IXFR
  9. 9. DNS RPZ .root Security Company .org Master DNS Who is in charge of RPZ AXF R IXFR RPZ is Caching Resolver DNSRPZ capability on theDNS Cashing Resolverallows zone transfers to What is the IP for pushed out in seconds.
  10. 10. DNS RPZ in Action Intel to findSecurity Company the badness Master DNS RPZ AXF R IXFR RPZ Caching Resolver DNS What is the IP for What is the IP for SPAM Computer looks up Xyzbadness. com
  11. 11. How is DNSRPZ Different?Security Company Master DNS DNS RPZ RBL Push Once AXFR IXFR Some Security RPZ Device Query Every Caching Domain Resolver DNS
  12. 12. Demo - before
  13. 13. Demo - after
  14. 14. What it looks like
  15. 15. How is DNSRPZ Different? Security •  DNSRPZ allows forCompany 1 multiple providers – building a richer list of Security “bad actors”Company 2 •  Allows for industry incident feeds. RPZ •  Allows for local incident OPSEC AXFR Caching management feeds. Incident IXFR Resolver DNSINFOSEC or Security Team
  16. 16. Possible DNS RPZ Uses•  Block or redirect malicious drop sites (DNS used by URLs)•  Block ability of C&C to find its way back using DNS•  Walled garden notification for infected clients•  Services that use PTR lookups (IP reputation can map into here).
  17. 17. Possible Uses Examples•  Enterprise networks can us it to stop infections – and let NOC know something is wrong.•  Hosting Provider can use it to block infected customer host – and let NOC know something is wrong.•  Service Providers – can use it to protect customers AND notify customer AND let the help desk know customers might be infected.
  18. 18. DNSRPZ Getting the Word out•  There was a healthy amount of pre-announced to operational security community to build a ecosystem.•  With BIND 9.8.1, we have a solid version for operators and networks to migrate and try DNSRPZ.•  ISC’s role is to now get the word out. The next wave of deployments would determine the utility of this security widget.
  19. 19. ISC’s Role with DNS RPZ•  ISC has three roles with DNS RPZ as a new “hammer” in our security toolkit:   Code and Functionality in BIND & working with all DNS Recursive Resolver Software Vendors to insure everyone is adopting the same formats.   Work with all potential Black List Providers.   Work with Operators on DNS RPZ Deployment.•  ISC will NOT be providing any black list capacities. Our role is to help design, build, and deploy the “hammer” as a new tool in our security toolkit.
  20. 20. Pause for Questions
  21. 21. Links while you are thinking …•  Discussion List ••  Taking back the DNS, Paul Vixie, 29th July 2010 • back-dns-0•  Google “taking back the dns”•  Draft Specification ••  BIND 9.8.1 •
  22. 22. Why We Need DNSRPZ?
  23. 23. Components of the Criminal Cloud Payment SPAM Processors BOTNET Drive-By Secondary Controller Proxy Malware Mule Operations  Avalanche: SPAM Cloud that you Name can lease timeServers  Zeus: IPv6 Compliant “Build your Own Criminal Cloud. BOT  BlackHole: Metasploit Cloud you Herder can lease Malware Victim of Crime TLD Domain Packer
  24. 24. Stage Domain Name SPAM BOTNET Drive-By Secondary Controller Proxy Malware Get Name DomainServers Stag e Do BOT mainStage on NS Herder or FF NS Malware Victim of Crime TLD Domain Packer
  25. 25. Prepare Drive-By Send Malware SPAM BOTNET Drive-By Secondary Controller Proxy Malware Load Name MalwareServers Hacker Malware Victim of Crime TLD Domain Packer
  26. 26. Social Engineered SPAM to Get People to Click (Spear Phishing) Send SPAM SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Click onServers me now Hacker Malware Victim of Crime TLD Domain Packer
  27. 27. Drive-By Violation Click on me now SPAM BOTNET Drive-By Secondary Controller Proxy Malware NameServers Hacker Malware Victim of Crime TLD Domain Packer
  28. 28. Drive-By Violation SPAM BOTNET Drive-By Secondary Controller Proxy Malware NameServers HackerOwned! Malware Victim of Crime TLD Domain Packer
  29. 29. Poison Anti-Virus Updates SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Poison the anti-virus updates Hacker All updates to Malware Vendor Victim of Crime TLD Domain Packer
  30. 30. Prepare Violated Computer SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Call to secondary Malware site Hacker Load secondary package MalwareAnti-Virus Vendor Victim of Crime TLD Domain Packer
  31. 31. Call Home SPAM BOTNET Drive-By Secondary Controller Proxy Malware NameServers Call to Controller Report:  Operating System Hacker  Anti-Virus  Location on the Net Malware  Software  Patch Level Victim of Crime  Bandwidth TLD  Capacity of the computer Domain Packer
  32. 32. Load Custom Malware SPAM Drive-By Secondary Controller Proxy Malware BOTNET Name Go get NewServers Module Hacker Malware TLD Victim of Crime Domain Packer
  33. 33. Start Worming, Scanning, & Spreading SPAM Drive-By Secondary Controller Proxy Malware BOTNET NameServers BOTNET Herder Malware IPv6 IPv6 Victims of Crime TLD Packer Domain
  34. 34. The Domain names were Black We know the SPAMListed! addresses We can see this guy’s SPAM Drive-By Secondary Controller DNS BOTNET Proxy Malware Activity! We knew the infrastructure We we knew addresses! the controller Name addresses! Servers BOTWe knew the NS Herder used for the We knew Malwarecriminal activity! the back end systems! TLD Victim of Crime Domain We needed to stop this computer from doing all the Packer DNS lookups to bad domains!
  35. 35. DNS RPZ would have stopped this attack! Send SPAM SPAM BOTNET Drive-By Secondary Controller Proxy Malware NameServers Blacklisted with DNSRPZ Hacker Malware Victim of Crime NOC TLD Alert! Domain Packer
  36. 36. We need to look “out of the Box”•  Put things in context – this illustrate was real.   The computer was up to date with all the patches.   The anti-virus was up to date.   The users getting hit with MEBROOT/Torpig were all using Firefox and Noscipt   Some of the users were security people.   The network was locked down with firewalls, IDPs, and all the other BCP recommended.   The zero day hit was orchestrated from the criminals known domains!
  37. 37. Pause for Questions
  38. 38. During the Questions …..•  How do you get support for DNSRPZ?•  Today, that is with BIND:   Public Benefit support through the community:   Public Benefit support through the ISC Knowledge Base:   BIND Software Support Package •  Yes! ISC does Internet Critical Software Support Services. • for a BIND upgrade package
  39. 39. DNSRPZ More Details
  40. 40. Original Problem Statement•  DNS is a decentralized system offering complete distributed autonomy. The relationships between operators and content owners are both tenuous and resilient.•  The split registry/registrar/registrant model insulates all parties from responsibility, so the global DNS lacks accountability. Complaints are ineffective, even with provable crime/losses.•  This resiliency and unaccountability benefits the bad actors committing cyber-crime.
  41. 41. Historical Context•  DNS is not unique in its unaccountability. Most Internet systems (mail, blogs, I-M) are similar.•  In e-mail its extremely common to subscribe to an DNSBL (realtime blackhole list) in order to reject messages from known-bad sources.•  Features similar to DNSBL exist for DNS in proprietary products (Nominum) and services (OpenDNS).•  RPZ (ISC Response Policy Zone) is an open standard for DNSBL-like features in the DNS.
  42. 42. DNS IND (&T)  IETF DNSIND working group (mid 1990s):   (I)ncremental zone transfer – RFC 1995   (N)otification of zone changes – RFC 1996   (D)ynamic update of zone content – RFC 2136   (T)ransaction signatures (TSIG) – RFC 2845  Pre-IND DNS zone changes had long latency, heavy bandwidth, and low trust – so, high cost  Post-IND DNS zone changes are immediate, with small deltas and good forward secrecy
  43. 43. RPZ History•  RPZ 1.0 released as patches to BIND9 in 2010:•  Rule-based system, triggered on query name/ type•  Rule-forced outcomes:   Return a fake alias (CNAME), for walled gardens   Return a fake NXDOMAIN, to blackout the name   Return a fake answer of the type being queried   Protect the name against subsequent policy triggers•  Subscription model: recursive name servers would become stealth servers for one or more RPZs.•  Rules/outcomes encoded as RPZ zone content.
  44. 44. DNS RPZ .root Security Company .org Master DNS Who is in charge of RPZ AXF R IXFR RPZ is Caching Resolver DNSRPZ capability on theDNS Cashing Resolverallows zone transfers to What is the IP for pushed out in seconds.
  45. 45. RPZ Content Examples (1)•  If is a response policy zone and is a name to be blacked out: CNAME .•  If all subdomains of are to be aliased to a local walled garden: * CNAME•  If should be redirected: A
  46. 46. RPZ Content Examples (2)•  If is to be protected from any policy action by any subsequent RPZ: CNAME•  If is to appear to be empty: CNAME *.•  If a A RRs in are to be replaced with a local walled garden address: A
  47. 47. RPZ Content Examples (3)•  If AAAA RRs in 2001:500:2f::/48 ought to cause fake NXDOMAIN responses, except 2001:500:2f::f which is to be returned as normal: CNAME *. CNAME .•  Note: “zz” in this context means “::”.
  48. 48. Lessons Learned From RPZ 1.0•  Sometimes the trigger has to be answer-based   E.g., if the A or AAAA RR is within a CIDR block   E.g., if the NS name or address is poisoned•  Sometimes the subscriber wants to import the triggers but locally specify the policy outcome   E.g., import a list of bad names, but decide locally whether to blackout or alias those names•  We have implemented some of these features in RPZ Format 2, released in BIND 9.8.0.
  49. 49. RPZ Data as DNS Control  DNS data maps <owner,type> record-set  RPZ data overloads <owner,type> as a trigger and record-set as an action  A hybrid recursive/authoritative name server which subscribes to one or more RPZs can answer untruthfully according to RPZ policy  RPZ data plane is promoted into the recursive DNS control plane according to name server configuration
  50. 50. RPZ Format 1 (in 2010)  Triggers:   Actions:   Q-name (all types)   Exemption   Q-name, Q-type   Force NXDOMAIN   Force empty answer   Force CNAME answer   Force specific answer
  51. 51. RPZ Format 2 (in 2011)  New Triggers:   New Actions:   Answer in netblock   None   Name server name   Name server address in netblock
  52. 52. Subscriber Configuration in BIND9options { // other stuff response-policy { zone ""; zone "" policy given; zone "" policy NO-OP; zone "" policy NXDOMAIN; zone "" policy NODATA; zone "" policy CNAME; }; };zone “” { type slave; masters {; }; // note: TSIG would probably be used in a production environment}; // and similar for the other rpz zones
  53. 53. Producer/Consumer Model in RPZ•  Producers can use RFC 2136 “UPDATE” to maintain their zone, or just periodically regenerate it and use “ixfr-from-differences” to tell BIND to compute deltas.•  Producers will use IXFR for efficient zone delta transmission, and TSIG for protection of RPZ data and authenticity of producer/consumer endpoints.•  Result: low cost, low bandwidth, low latency, and strong data protection.
  54. 54. Possible Good•  Specialization of labor: security experts can produce robust and targeted patterns for use by customer DNS recursive name servers.•  Competition: many security experts, many name server implementers (not just BIND!), and a global market of potential customers.•  Effect on crime: a domain or IP address used only for evil will not remain usable even if its registrant, registrar, registry, or ISP never suspends or terminates it.
  55. 55. Possible Harm•  Governments could use RPZ to enforce laws about censorship, since it is an open standard.•  Some RPZ data sources will inevitably be politically, racially, or religiously motivated (“all Christian web sites” or “all Muslim web sites”).•  As with all reputation systems, the systemic effect on DNS will be to make it less reliable and harder to diagnose or characterize.•  We hope these effects will be more pronounced on bad actors than on the rest of us.
  56. 56. Pause for Questions
  57. 57. During the Questions …..•  Download & save for later reading the Protect IP Paper:•  Security and Other Technical Concerns Raised by the DNS Filtering Requirements in the Protect IP Bill. •  Security Week Article:
  58. 58. DNSRPZ Providers
  59. 59. ActiveTrust® Resolver RPZ•  Focused on enterprise threats   Malware distribution and communications   Phishing, including spear-phishing   Data exfiltration•  Constantly updated with fresh information   Market-leading detection of phishing and malware sites   Criminal infrastructure analysis using passive DNS   Malware reverse-engineering including DGAs   Detection and analysis of anomalous DNS requests•  Updated every 15 minutes•  Optional TrapTrace™ redirection and analysis service to determine who, what, when for blocked connections   Detailed info on threats on your network from IID Threat Intel Team•  More info at
  60. 60. DNS  RPZ  &  SURBL      •  What  is  SURBL  RPZ?      SURBL  RPZ  is  a  version  of  SURBLs  high-­‐quality  an>-­‐spam,  an>-­‐phishing  and  an>  malware  data  in  the  form   of  a  DNS  Response  Policy  Zone  (DNS  RPZ).  DNS  RPZs  are  used  to  deny  or  modify  the  resolu>on  of  low-­‐ reputa>on  domains,  in  other  words,  to  deny  DNS  services  for  known-­‐bad  domains.  SURBL  is  the  worlds  first   provider  of  RPZ  data.    •  Why  use  SURBL  RPZ?      SURBL  RPZ  data  are  typically  used  to  protect  users  from  visi>ng  objec>onable  or  dangerous  spam,   phishing  or  malware  web  sites.  Doing  so  can  prevent  iden>ty  theN,  phishing  aOacks,  malware  infec>on,  loss   of  revenue  due  to  visi>ng  objec>onable  spam  sites,  and  more.  This  is  made  possible  by  SURBLs  highly-­‐ regarded,  mul>-­‐sourced,  real-­‐>me  intelligence  about  such  domains.    •  How  to  use  SURBL  RPZ      SURBL  RPZ  is  available  via  DNS  zone  transfer  using  recent  versions  of  BIND  9.  Local  SURBL  RPZ  queries  are   answered  by  your  local  BIND  recursive  nameserver  where  they  can  be  used  to  deny  resolu>on  (NXDOMAIN   is  the  default  behavior)  or  to  send  traffic  to  a  local  walled  garden  for  example,  instead  of  allowing  the   successful  resolu>on  known-­‐bad  domains.  Other  RPZsupported  behaviors  are  available  by  modifying  the   response  values  as  needed  in  your  opera>onal  environment.  SURBL  RPZ  data  are  available  by  private   incremental  zone  transfer.     Please  contact  us  using  the  Data  Feed  Request  form  on  our  web  site  in  order  to  arrange  access,  or  call  Arnie  Bjorklund    302-­‐231-­‐1201,  
  61. 61. Questions?
  62. 62. Don’t get Caught Off Guard with Old BIND!•  Get Professional Support to help you upgrade BIND! •  Special Offer Software Support & Consulting Deal!   Take advantage of this special deal that combines 6 months of Basic Support & 8 hours of Expert Consulting to get your organization started with BIND support, have enough support time to get your systems upgraded, and convince management to budget for critical DNS infrastructure support.•  Webinar Special Discount!   ISC will E-mail all participants after the webinar. If you did not get or cannot wait, E-mail to
  63. 63. ISC In a Nutshell Forum Professional Services Public Benefit Services•  BIND •  Consulting •  DNS “F-ROOT”•  BIND 10 Working Group •  Training •  DNS Secondary Server•  DHCP •  Software Support Services Resiliency (SNS) PB•  AFTR/PCP •  Custom Software Development •  Hosted@ - hosting a range of open source code)•  SIE •  F-root Corporate Node •  •  Free Domain Survey Report•  Open Source Routing DNS SNS-Com •  Full version The Domain Survey •  ISC assistance at IETF, ICANN, ARIN, ISOC RIPERPKI (Securing BGP) and more WG, UKNOF, etc to come … first reference, standards based code. Empowerment •  Standards drivers – with first implementation of standards based code. •  Policy Meetings – Empowering Spheres of Influence •  Operational Security – Pioneering new approaches to safe guard the Internet (OPSEC-Trust). •  Operations Meeting Empowerment (APRICOT, AFNOG, NANOG, etc) •  Research (DNS OARC)
  64. 64. New from ISC
  65. 65. ISCTechnology Leadership for the Common Good