Data Theft via DNS – Are You Safe?

With cybercriminals using increasingly sophisticated mechanisms, and insider threats still prevalent, organizations have come to accept that the threat of a data breach is here to stay. Rather than wondering “if” my business will become a victim of data theft or ransomware, the question now is “when”. The market stats are pretty scary: according to AV-Test Institute, more than 1 billion malware programs exist, and Sonic Wall’s 2022 report states that 40 million ransomware attacks occur every month. 

Despite all the protection methods put in place by companies, one component is often overlooked – their DNS. Being open by design, DNS is a favorite service to utilize for exfiltrating data without being easily detected by firewalls and IPSs. So to ensure data confidentiality, as well as for avoiding regulatory fines like GDPR, US Cloud Act, and PDPA, specialized DNS Security mechanisms and tools to detect exfiltration via DNS have become imperative.

Why DNS is a Favorite Service for Data Theft

DNS is an open service by essence, enabling connection with external apps (websites, Cloud etc..). But as DNS isn’t generally associated with data delivery, it is often overlooked. 

“DNS is rarely monitored and analyzed, and the DNS tunneling activity usually slips under the radar. This makes DNS exfiltration an “easier” option than other means of data theft.” – Duncan Brown, VP European Security, IDC

Cybercriminals benefit from this assumption to bypass security mechanisms for transporting sensitive data from inside to outside the enterprise. The DNS protocol is used as either a tunneling protocol or as a ‘file transfer’ protocol. Palo Alto research shows that over 80% of malware uses DNS to identify a command-and-control (C2) server to steal data and spread malware/ransomware. 

Firewalls and DLP systems find it difficult to detect this exfiltration in a timely manner, so most businesses don’t even know that data is being stolen until it’s too late.

Conventional Network Security Components are Limited

Many organizations we speak to feel confident with their data protection. They have DNS security on their firewalls, they have endpoint protection, IDS, IDP, network traffic analysis tools, plus email and web filtering to ensure “the nasty stuff” doesn’t reach their users. Whilst these tools are excellent, their threat analysis methods to detect data exfiltration is limited. So when businesses run tests using EfficientIP’s test tool, they pretty much always find that data can be easily exfiltrated via their DNS. According to IDC’s 2022 Global DNS Threat survey, one in four organizations confirmed they have suffered data theft via DNS.

NGFWs, for example, often use pattern matching, signatures, and databases of known bad/malicious domains. But what if the threat isn’t able to be pattern matched? Or the domain is not yet identified as a bad domain? Hackers are smart and tend to use domains with good reputation to walk through security systems!

To protect data confidentiality, organizations need to look beyond traditional security. Performing checks close to “the source”, such as by investigating DNS data coming from end-users, would make a lot of sense. This enables verification of “intent” before malicious transactions are able to start. In addition, it allows considerable load to be taken off the firewalls which are already very busy. It all comes back to having defense in depth across your cyber security stack. 

How to Better Secure Your DNS

When it comes to securing DNS, the ideal method is to use the DNS itself. Monitoring DNS transactions is a great start, but it becomes even more valuable when intelligent analysis is applied. Making use of user behavior analytics and client context information significantly increases insight into potential exfiltration attempts. 

EfficientIP’s approach to data protection consists of: 

• 1) Use of real-time DNS analytics (with no performance impact) for behavioral threat detection
• 2) Deployment of adaptive countermeasures to block DNS-based data exfiltration

Fast remediation and centralized reporting functionalities are then added to enhance the data confidentiality protection process.

Our DNS Guardian allows for a complete understanding of the client’s context, thus overcoming limitations of signature-based security systems which offer only limited peripheral traffic visibility. This is key for delivering true DNS analytics and behavioral threat detection capabilities. DNS Guardian’s unique DNS Transaction Inspection (DTI) helps build a powerful intelligence base concerning DNS services. It provides an adaptive capability that is kept current despite new domains being created and registered (for example, using DGAs). The result is that suspect client activity can be detected even before the related domain has been specified as being malicious. And as legitimate customers can be differentiated from malicious actors, the risk of blocking or quarantining legitimate traffic is also dramatically reduced.

For countering exfiltration, near real-time threat intelligence can be obtained by combining DNS Guardian with EfficientIP’s DNS Firewall. This takes threat response efficiency to another level, permitting permanent blackholing of locally identified suspicious domains. 

EfficientIP’s Free Data Exfiltration Test Tool 

To check how safe you really are from data theft, at EfficientIP we offer a free test which takes only 5 minutes. Specifically-designed web-based tools allow you to conduct a data exfiltration test on your network. The test is a structured “ethical attack” on your DNS system to identify if data exfiltration using DNS is possible. It uses the same (non-intrusive) tools and techniques that real attackers use to break into networks. Read-only actions are performed, with no configuration modifications.

The test involves 3 quick, easy, non-intrusive steps:

• Select the data you want to exfiltrate
• Start the exfiltration test
• Watch the data being exfiltrated in real-time!

After the test, a post-briefing is performed, to provide:

• Explanation of test results: a description of the “stolen data” is shown as proof of what was detected
• Recommended actions & countermeasures