Embed Size (px)
Citation preview
1 VNIX-NOG 2019
Làm cho Internet an toàn với tường lửa DNSMake the Internet safe with DNS firewall
Response Policy Zones (RPZ)
2 VNIX-NOG 2019
Châu á tuyệt vờiGreat Asia
Khu vực phát triển nhanh nhấtcủa các mối đe dọa mạng
Fastest Growing Area of Cyber ThreatsOver 200 Billion devices connected worldwide by 2020.
Over 13 million active bots recorded for January 2019.
Most activity coming from countries within the ASEAN region.
3 VNIX-NOG 2019
Những loại mối đe dọa mạng?
What types of cyber threats are there?
4 VNIX-NOG 2019
Lừa đảo - Phishing & BEC
VNCERT Reported:
Các trang web Việt Nam “hứng” hơn 6.200 cuộc tấn công mạng trong 6 tháng đầu năm
In 2018:
3,818 cybercrime deface attacks
1,800 phishing attacks
949 phishing attacks
Businesses in Vietnam suffering close to $642 million in losses.
Jan2019 – Jul2019 6,219 cyber attacks
5 VNIX-NOG 2019
Tải xuống độc hạiMalicious Downloads
Ransomware Malware Root Kits
www.Singaporeair.com.promotion.winner.Werzfwervjiaeirsvisatlserkvalesrebiajrsre.ga
6 VNIX-NOG 2019
93b375dd6cd9f2704d613d1016dbe0f2.info
93b375dd6cd9f2704d613d1016dbe0f2.tk
afcc0c1f4b9fd590a61ba1c24b49b525.ga
afcc0c1f4b9fd590a61ba1c24b49b525.info
afcc0c1f4b9fd590a61ba1c24b49b525.ml
afcc0c1f4b9fd590a61ba1c24b49b525.online
bbc16e2659b9b9b5128c2f7e5877d29b.cf
bbc16e2659b9b9b5128c2f7e5877d29b.ga
bbc16e2659b9b9b5128c2f7e5877d29b.gq
f62b550a0e5e4f234fdd30c927665c91.xyz
1BO
T
Thuật toán tạo tên miềnDGA Domain Generating Algorithm
7 VNIX-NOG 2019
Websites Mobile Applications Servers
Cryptojacking
8 VNIX-NOG 2019
C&C SERVER
BO
T
C2 Command & Control Servers Infected Nodes & Devices (Bots)
Chỉ huy và Kiểm soát (C2)
Botnet và Bots
9 VNIX-NOG 2019
SMSSmishingPhishingVishing
Malware
1
C2 - BOT
Command & Control (C2)DDoSSpamTrojan
MalwareRansomware
DDoS
BOT
c
B
O
T
B
O
T
B
O
T
B
O
T
B
O
T
B
O
T
B
O
T
B
O
T
B
O
T
Quy trình làm việc của tội phạm mạng(ex. Roaming Mantis)
1
10 VNIX-NOG 2019
8051914
12927176
0
2000000
4000000
6000000
8000000
10000000
12000000
14000000
2017 World 2019 World
2019
2017
Global Bots
8,051,914
12,927,176
BO
T
11 VNIX-NOG 2019
Có bao nhiêu bot ở việt nam?
How many bots in Vietnam?
12 VNIX-NOG 2019
11
0
20000
40000
60000
80000
100000
120000
140000
160000
180000
200000
Vietnam Bots
544,780
967,110
2019
2017
BO
T
BO
T
BO
T
13 VNIX-NOG 2019
Xếp hạng thế giới
14 VNIX-NOG 2019
BOTS BO
T
15 VNIX-NOG 2019
chúng tôi có bảo mật
We already have a firewall.
We have a proxy/web filter.
We use endpoint security.
We have a SIEM.
Let’s have a look.
16 VNIX-NOG 2019
chúng tôi có một tường lửaWe have a Firewall and IPS/IDS
rất nhiều hướng dẫn sử dụng
Requires manual configuration
of policies.
Configuration of firewall rules.
Delay between updates and
difficult to know if it is actually
effective.
17 VNIX-NOG 2019
lọc web và proxyWe have a web proxy or web filter
Needs to be installed and managed per client.
Usually only browser based and limited
support.
Only effective on HTTP traffic.
Https is likely not supported.
trên mỗi thiết bị, không thể mã hóa
18 VNIX-NOG 2019
Nhóm SOC và SIEMWe have a SOC team and SIEM
Extensive data analysis to identify
threats.
Usually requires post data correlation.
Difficult to manage across various
systems and logs.
trên mỗi thiết bị, không thể mã hóa
19 VNIX-NOG 2019
Sơ đồ mạng truyền thốngYour Network
20 VNIX-NOG 2019
thế giới mạng bây giờ trông như thế nàoWhat does the cyber world look like?
21 VNIX-NOG 2019
www.shodan.io
22 VNIX-NOG 2019
23 VNIX-NOG 2019
24 VNIX-NOG 2019
25 VNIX-NOG 2019
26 VNIX-NOG 2019
27 VNIX-NOG 2019
28 VNIX-NOG 2019
Tăng trưởng kết nối và tốc độ
29 VNIX-NOG 2019
30 VNIX-NOG 2019
Robotics và Drone
Robotics
31 VNIX-NOG 2019
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
BO
T
IOT
32 VNIX-NOG 2019
A.K.A Light Leafon14 Years Old
33 VNIX-NOG 2019
Các cuộc tấn công mạng có điểm gì chung?
What do cyber attacks have in common?
34 VNIX-NOG 2019
35 VNIX-NOG 2019
Cách thức hoạt động của DNS
How DNS works
Where is www.google.co.jp
.COM
.NET
.CO.JP
ISP
Query: www.google.co.jp
DNS Resolver Other DNS Servers
Where is www.google.co.jp?
Query: www.google.co.jp
Cname: www.google.co.jp
Do you know www.google.co.jp?
The Internet Address Book
36 VNIX-NOG 2019
Hoạt động DNS độc hại
Malicious activities also need DNSMalicious Activity also uses same DNS
Where is www.goog1e.co.jp?
.COM
.NET
.CO.JP
ISP
Query: www.goog1e.co.jp
DNS Resolver Other DNS Servers
Where is www.goog1e.co.jp?
Query: www.goog1e.co.jp
Cname: www.goog1e.co.jp
Do you know www.goog1e.co.jp?
BO
T
MALICIOUS ACTIVITY
1
www.nttdocono.com
www.badguys.com
Dgaefcaseiwoweijvkajl.com
37 VNIX-NOG 2019
Điều gì xảy ra nếu chúng ta có thể chặn các mối đe
dọa đã biết và chưa biết?
Tên miền này có an toàn không?
What if we can block known and unknown attacks?
38 VNIX-NOG 2019
Những gì là DNS Response Policy Zones (RPZ)
Mechanism to introduce a customized policy
in Domain Name System servers
Developed by ISC, First introduced at Blackhat
2010 and developed by P.Vixie and V.Shryver
https://tools.ietf.org/html/draft-vixie-dnsop-dns-rpz-00
https://dnsrpz.info/
39 VNIX-NOG 2019
Tên miền này có an toàn không?
DNS with Response Policy Zones
Where is www.goog1e.co.jp?
.COM
.NET
.CO.JP
ISP
Detect
Alert
Redirect
Block
Forensics
Query: www.goog1e.co.jp
DNS Resolver Other DNS Servers
Where is www.goog1e.co.jp?
Query: www.goog1e.co.jp
Cname: www.goog1e.co.jp
Do you know www.goog1e.co.jp?
BO
T
MALICIOUS ACTIVITY
1
www.nttdocono.com
www.badguys.com
Dgaefcaseiwoweijvkajl.com
Is this domain safe?NXDomain
CnameSinkhole
40 VNIX-NOG 2019
DNS Logs + ELK Stack
Where is www.goog1e.co.jp?
ISP
RPZ Data
Query: www.goog1e.co.jp
DNS Resolver Log Report
Where is www.goog1e.co.jp?
Cname: www.goog1e.co.jp
Who accessed goog1e.co.jp?
BO
T
Malicious Activity
1
NXDomainCname
Sinkhole
Level Source Threat Type
Critical 10.24.31.13 C2 Comm
Critical 131.31.23.13 Malware Domain
High 34.123.22.41 Ransomware
High 51.1.31.44 DGA Domain
41 VNIX-NOG 2019
IOT & Thiết bị bị nhiễmIoT and Infected Devices
Where is Ccdomains.co.jp?
ISP
RPZ Data
Query: CCdomains.co.jp
DNS Resolver Log Report
Where is Ccdomains.co.jp ?
Cname: CCdomains.co.jp
Who accessed
CCdomains.co.jp?
Infected Devices
1 Level Source Threat Type
Critical 10.24.31.13 C2 Comm
Critical 131.31.23.13 Malware Domain
High 34.123.22.41 Ransomware
High 51.1.31.44 DGA Domain
42 VNIX-NOG 2019
Hoạt động độc hại nội bộInternal Malicious Activity
Where is company AD server?
DNS
Query: Corporate AD
DNS Resolver Log Report
Scan for AD or other Internal Servers Who accessed AD Server?
Malicious User
Level Source Threat Type
Critical 10.13.22.31 Active Directory
Critical 10.13.22.31 Active Directory
High 10.13.22.31 MS Exchange
Low 51.1.31.44 Other AD
Active
Directory
Server
43 VNIX-NOG 2019
Ca sử dụng: Triển khai tại một ISP lớn
Use Case: Implementation at a major ISPBIND 9 DNS Server
LXD Container with Ubuntu 18.04 , vCPU:8 cores,Memory : 8GB,Storage:100GB.
ELK Stack
Log Collection and data visualization.
LXD Container with Ubuntu 18.04 vCPU:4 cores,Memory : 4GB,Storage:100GB
RPZ zones Data feed from RPZ feed provider.
www.dnsrpz.info
44 VNIX-NOG 2019
Các mối đe dọa và chính sách được phân loạiClassified Threats and Policy Zones
Following RPZ zones were added at the end of the /etc/bind/named.conf.options
using the response-policy.Bind currently has a 32 zone limit
Extemely easy to setup.
Classified threats include.
Phishing
Malware
Criminal Networks
Bad Nameservers
Malicious Adware
Cryptominer
CryptJacker
And more.
response-policy {
zone "rpz.local";
### 11 Standard Feeds
zone "adware.host.dtq";
zone "badrep.host.dtq";
zone "bad-nameservers.ip.dtq" ;
zone "bad-nameservers.host.dtq";
zone "bogons.ip.dtq";
zone "botnetcc.host.dtq";
zone "botnet.host.dtq";
zone "botnetcc.ip.dtq";
zone "dga.host.dtq";
zone "malware.host.dtq";
zone "phish.host.dtq";
Sample Configuration
5 Min Install
45 VNIX-NOG 2019
RPZ zones will be downloaded from feed provided as a slave zone.
zone "malware.edit.host.dtq" {
type slave;
file "dbx.malware.edit.host.dtq";
masters {199.168.xx.xx;199.168.xx.xx;199.168.xx.xx; };
allow-transfer { none; };
};
Bind RPZ Logging:
channel rpzlog {
file "rpz.log" versions unlimited size 1000m; print-time yes;
print-category yes; print-severity yes;
severity info;};
category rpz { rpzlog; };
Cấu hình đơn giản: Thu thập dữ liệuSimple Configuration : Acquire data from master RPZ servers
46 VNIX-NOG 2019
Giám sát dễ dàng cho hoạt động DNS của bạnEasy Monitoring For Your DNS Activity
The ELK stack is a collection of three open source tools -
Elasticsearch + Logstash + Kibana along with log shipper
47 VNIX-NOG 2019
Simple configurations: Parse/filter logs with Logstash
filter {
if [source] == "/var/cache/bind/rpz.log" {
grok {
match => [ "message", "%{DATA:NC_timestamp} %{DATA} %{GREEDYDATA}info:
%{DATA:X_client} %{GREEDYDATA:X_step2}" ]
}
date {
match => [ "timestamp", "MMM dd HH:mm:ss", "MMM dd HH:mm:ss" ]
}
#### drop unneeded events by X_client
if [X_client] != "client"{
drop { }
}
mutate {
remove_field => [ "X_client" ]
}
48 VNIX-NOG 2019
Xác định các thiết bị đáng ngờIdentify Suspicious Devices
49 VNIX-NOG 2019
Xác định các thiết bị đáng ngờIdentify Suspicious Devices
50 VNIX-NOG 2019
Phân loại sự kiệnClassify Events
51 VNIX-NOG 2019
Xác định vấn đềIdentify Issues
52 VNIX-NOG 2019https://www.joesandbox.com/analysis/37219/0/executive
53 VNIX-NOG 2019
54 VNIX-NOG 2019
Bảo mật đơn giản ở nhiều cấp độ là bắt buộc
IP DNS URL AUTH CVE
55 VNIX-NOG 2019
Thank you !
For more info: www.pipelinesecurity.net
https://dnsrpz.info/
56 VNIX-NOG 2019
How can DNS RPZ protect your network
● Due to HTTPs filtering on proxy is almost no point of use.● DNS Firewall works on recursive DNS servers ● Its easy to classify threats based on threat intelligence● Over 91% percent malware uses DNS(As Cisco 2016 Annual Cyber security report)
● Use Of DNS Firewalls Could Reduce 33% Of All Cybersecurity Breaches, New Global Cyber Alliance Research
Finds.According to the study, DNS firewalls might have prevented $10 billion in data breach losses from
the 11,000 incidents in the past five years. https://finance.yahoo.com/news/dns-firewalls-could-reduce-
33-140000777.html
● No new infrastructure needed to implement
● All open source tools used
● Easy to handle false positive
● RFC: https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz-00
