CleanDNS technical overview

1. #Because Detection is Cool but Proactivity is Better!

2. •Technical Approach
•Examples
•Sources
•References

3.  CleanDNS methodology is based on Defense
In Depth approach using a 4 phase approach,
as follows:
 1 – Network DNS Request Filtering;
 2 – DNS Domain Sinkhole;
 3 – DNS Secure Last Resource;
 4 – Network DNS Response Filtering;

4.  A typical malware DNS flow.

5.  A typical non malware DNS flow.

6.  A DNSTunneling DNS Request
 = 1 - Network DNS Request Filtering

7.  A Suspicious LowTTL DNS Response
 = 1 - Network DNS Request Filtering

8.  A know malware domain by SNORT
 = 1 - Network DNS Request Filtering

9.  A know malware domain by local Database
 = 2 – DNS Domain Sinkhole

10.  A know malware domain byOpenDNS
 = 3 – DNS Secure Last Resource

11.  A know malware IP address
 = 4 – Network DNS Response Filtering

12.  1 – Network DNS Request
Filtering;
 SNORT Community Rule Set;
 Proofpoint Emerging Threats Open
Rule Set;
 Customized Anti-DNSTunnel Rules;
 2 – DNS Domain Sinkhole;
 Malware Domain BlockList;
 ZeusTracker;
 Ransomware Tracker;
 Malware Domain List;
 Shalla`s Blacklist;
 Dshield;
 URL Blacklist;
 3 – DNS Secure Last Resource;
 OpenDNS itself;
 4 – Network DNS Response
Filtering;
 Ransomware Tracker;
 Dshield;

13.  Detecting DNSTunneling;
 https://www.sans.org/reading-
room/whitepapers/dns/detecting-dns-tunneling-
34152
 DNS Sinkhole by SANS;
 https://www.sans.org/reading-
room/whitepapers/dns/dns-sinkhole-33523
 Detecting and Blocking DNSTunneling
with Custom Signatures;
 https://community.mcafee.com/thread/87616
 Ransomware Tracker;
 https://ransomwaretracker.abuse.ch/
 Malware Domain List
 https://www.malwaredomainlist.com/
 Shalla`s Blacklist
 http://www.shallalist.de/
 Malware Domain Blocklist
 http://www.malwaredomains.com/
 ZeusTracker
 https://zeustracker.abuse.ch/
 Dshield
 https://www.dshield.org/
 URL BlackList
 http://www.urlblacklist.com/
 Proofpoint Emerging Threats
 https://www.proofpoint.com/us/products/et-
intelligence
 Snort
 https://www.snort.org/
 OpenDNS
 https://www.opendns.com/

14. #Because Detection is Cool but Proactivity is Better!
• Project Page: https://www.facebook.com/cleandns
• Download: https://cleandns.sourceforge.net