MultivariateSolutionstoPassiveDNSChallengesMerikeKaeoCTOFarsightSecuritymerike@fsi.ioAAgendaSIVEDNS?Startwithaknown/observedbaddatapoint?Domainname?Nameserver?IPaddress/CIDR?ASN?UsePassiveDNStofindotherIPsordomainnamesthatsharethesameresources?Leveragereputationlocalitybutcarefullyreviewwhatyou’vefound?Useasinglepointofcommonalityasawaytoidentifyrelateddomains?SAMEexactIP??SAMEexactnameserver??SAMEexactdomainnameusedovertime(ifyouareinterestedinthesetofIPsthatanamehasbeenusing)?Eachreliesonasingleattribute,exactlymatched?ManyrelateddomainscoexistonasingleIP(orsmallCIDRblock),withnoinnocent3rdpartydomains?Manyrelateddomainsusethesamesetofdedicatednameservers,withnoinnocent3rdpartydomains?ThemalicioususerisapparentlystubbornlyfondofafavoritedomainLENGES?ZEROinterrelateddatapoints–e.g.“l(fā)onewolf”domainnames,IPaddresses,nameservers,etc.?Toomanyrelatedresources?Maliciousresourcesarecomingledwithinnocent3rdpartyresourcesThecybercriminalreusesNOTHINGacrosssites?EveryIPaddressusedtosendSPAMorhostcontentistotallyunrelatedtoanyotherIpsthecriminaluses?Everydomainnameisregisteredusing:?Adiverseassortmentofregistrars,oneortwoatatime?Uniquenameservers(installedandoperatedonuniqueIPs)?Unique/fictitious(orconcealed)POCdetails?Unique(oranonymous)paymentdetails?Example#1:ProviderfailstodocumentIPreassignments/reallocationsmoved)aroundasinglelargenetworkblock,oramongmultiplesmallerblocks.?Example#2:WHOISPOCdetailsareconcealedbyaWHOISproxy/privacyservice?Lookforothercharacteristicsthatmaynotbeobfuscated,orseektostripawayanonymity?Examples?Ifnameserversservicealargenumberofdomains,andthusarenotausefulattributetotrytofollow,lookattheIPaddress(es)thebaddomainishostedon,instead.?Ifadomainisdemonstrablyengagedinphishingorotherclearlyillegalbehavior,someprivacy/proxyprotectionserviceshavetermsofservicewhichallowtheprovidertounilaterallystripprivacyprotections.?WithReverseProxies,everythingseemsto“l(fā)iveonthereverseproxy’sIPaddresses”?Carefullyscrutinizenon-A/non-AAAADNSrecordsthatmaybepresent(e.g.XTetc?Reverseproxyoperatorsarealsopotentiallyaterrifictargetbylawenforcements?EncodedURLs,uniquetoeachspecificrecipient?BecauseeachURLisuniquetoeachrecipient,visitingtheURL(typicallytoinvestigatethesitebeingspamvertised)means:?Confirmingyou'veopenedthemessageandclickedthrough(establishingapotentialargumentthatyou've"opted-in")?Mayresultinyou"using-up"aURLcodedforone-time-use(trythesameURLa2ndor3rdtime?Itmaygonowhere)?Forwarding"sanitized"spamplesincomplaintsmayyieldURLsthatsimplydon'twork,orwhichwork"misleadingly."?Forwarding"rawspamplesincomplaints"outs"yourspamcollectioninfrastructureandmayresultin"listwashing.”?Inamultivariateapproachwelookatmorethanonemeasurementatthesametime?Thisallows“interactions”tobeaccountedfor?xbyitself?okay?ybyitself?okay?xandycombinedtogether?DoesNOTwork!?NOTcombiningmultipleattributesintoasinglescore,comparedagainstathreshold(SPamAssassinstyle)?NOTjustsuccessiveapplicationofindependentunivariatefilters,either/wiki/File:Multivariate_normal_sample.svg?CurrentlypassiveDNScapturesdataaboutthreemaintypesofDNS-relatedentities:?Names?IPs?NameServers?Noneofthatisbeautifulcontinuousdata?Ifyouattempttovisualizeit,itwillNOTlookliketheprettygraphonthecedingpagetisticaloptionsfornominalarelimited:youcandocrosstabs,but(a)that'snotverystatistically"sexy,"and(b)interpretationeshardasthetablesizeAugmentingClassispDNS?CombinepassiveDNSdatawithothernon-DNSdatatogo“multivariate”?Non-DNSdatacouldbepre-existingdatasuchasdomainWHOISorIPWHOISdata?CollectnewdatatoaugmentpassiveDNSdataset(whereactivescanningisallowedbylawandbyyournetworktermsofservice)?Forexample,fingerprint/scanhostswithNMAPorasimilarscanningtooltoseewhatpatternsofports(ifany)areopenonarangeofIPaddresses?Createanewdomainname?Specifythedomainyouwanttoregister?Provide(supposedlyaccurate)pointofcontact(POC)details?DecideifyouwanttohavethosePOCdetails“unlisted”throughuseofaprivacy/proxyregistrationservice?DefinetheauthoritativenameserversthatknowhowtomapyourdomainstotheIPaddress(es)ofyourserver?Payanannualfeetotheregistrar?POCinformationandrelateddetailsaboutmostdomainsgetaddedtoanonlinedatabase-WHOISrldIdentities?Cluestoregistrant“realworld”identityinWHOIS?Theirname(butclaimednamemaybebogus,orsomeoneelse’snameusedwithoutauthorization)?Astreetaddress(canbea3rdpartymaildrop,incomplete,fictitious,etc)?Aphonenumber(maybeaprepaid“burner”phone)?Anemailaddress(maybethrowawayandonlyusedonce)?Ifyouhavetheabilitytogetacourtorder?Theircreditcardnumber(maybestolenorprepaidorpaidusingBitcoin)?AnIPaddressformwhichtheyplacedtheirorder,etc.?Proxy/privacyprotectionmaybefree(bundledwithadomain’sregistration),orofferedasanextracostservice?Proxy/privacyservicesallowregistrantstoconcealtheircontactdetailsfrompublicdisplay?Evenifused,LEOscanstillseekacourtordertostripadomain’sproxy/privacystatusortodirectlyobtainunderlyingdetails(butthiscanbeapainandunderlyingdetailsmaystillbebogusorrequireadditionaldeobfuscation)[/2015/07/how-to-register-a-gtld-domain-name-without-disclosing-personal-data.html]?Someproxy/privacyserviceprovidersmayhaveTOSwhichallowthemtounilaterallyremoveprotectionsforadomain(ifadomainisobviouslybeingmisused,e.g.forphishingorSPAM)?IPaddressesmayhaveanassociatedgeolocation(fromIPWHOIS)?IPaddressesmayALSOhaveanassociatedgeolocationfromageoIPdatabase?Domainsmayhaveanassociatedgeolocation(fromdomainWHOIS)?IPaddressesmayhaveanassociategeolocationduetouseofacountrycodeTLDInconsistenciesmaybeinnocentorasignofsomethingworthscrutiny?ICANNadministersglobaltopleveldomains(gTLDs),.net,.org,.biz,.info,etc.)ICANNrequiresWHOISservice(althoughtheypermitprivacy/proxyregistrations)?CountrycodeTLDs(ccTLDs)arerunaccordingtotheirownrules.SomeofthemhavepolicieswhichlimitpublicaccesstotheWHOISdataforany/alloftheirdomains[*IF*theWHOISinformationactuallyexists]?WHOISinformationmayonlybeavailableandusablebyregisteredusers?SomeWHOISinformationmaybedisplayedingraphicalformattohinderautomated“scraping”/cut-n-pastingofWHOISdata?WHOISaccessmaybestrictlyratelimited,withaccessslowedorblockedaltogetherafterjustahandfulofdomainsarecheckedfromthesameIPaddressDURINGPUBLICEVENTS$nmsgtool-Cch208-c5000000|greprrname|awk'{print$2}'|sed's/.$//’|grep"olym"|grep-v"polymer">olymp.txt$reverse-domain-names<olymp.txt|sort|uniq-c|sort-nr>temp-olym.txtmpicslivewwweedbackathleticsacoolympicpaintsdutopolympialympiadenwolympiquecotedorsmolympicssports?Mostnewdomains(<24hours)arenefarious?60%ofSPAMstudiedusedheaderorenvelopedomain<24hoursold?Mostnewdomainsdon’tyethaveareputation?NODasStreams(newlyactivevsnewlyobserved)?NODasFeeds(RPZ–DNSFirewall;RHSBL–SpamAssassin)?Variousintervalsavailable(5m,10m,30m,1hr,6hr,12hr,24hr)????????????1363288-irish-executive-arrested-in-rio-olympics-ticket-raid[dot]pagederelict-and-deserted-the-ghost-of-former-olympic-sites[dot]pagehelen-skelton-strictly-come-dancing-olympics-bbc[dot]pageolympic-council-of-ireland-employee-arrested-in-ticket-raid[dot]pageolympic-diving-pool-turns-green-and-baffles-competitors[dot]pageolympic-rio-gang-steal-dog-pet[dot]pageOlympicsgames[dot]clubrio-2016-diving-pool-green-olympics-tom-daley[dot]pagerio-olympics-gymnast-breaks-leg-video[dot]pageRio2016olympics[dot]todayrio-olympics2016[dot]onlineRioolympics2016[dot]today?Rioolympicsgame[dot]club?Rioolympics[dot]solutions?Rioolympics[dot]space?Rioolympics[dot]tech?Riosportsolympics[dot]online?Olympicsrio2016[dot]online?Olympicsrio2016[dot]today?Watchbrazilolympics[dot]online?watch-olympics16-livesnow[dot]ga?Watchtheolympics[dot]online?Winterolympics2018[dot]xyz?Winterolympics[dot]press????????????Dolympic]dot]deEsportolympics[dot]nlEsportsolympics[dot]nlJordan72016olympic[dot]ccOlympicamsterdam[dot]nlOlympicbikes[dot]nlOlympiccasino[dot]nlOlympicconsultants[dot]nlOlympiccrowdfunding[dot]deOlympiccrowdfunding[dot]nlOlympicentertainment[dot]nlOlympicgamesnews[dot]de?Olympichub[dot]nl?Olympicit[dot]nl?olympic-klasse[dot]de?olympic-land[dot]de?olympic-land[dot]nl?Olympicland[dot]nl?Olympicnews[dot]io?Olympicoffers[dot]de?olympic-parc[dot]de?olympic-parc[dot]nl?Olympicpetfood[dot]nl?olympic-travel[dot]de?Olympicycles[dot]nl?Radiolympic[dot]nl?Radiolympics[dot]nl?Sociolympic[dot]nl?Sociolympics[dot]nl?Specialolympics2017[dot]nl?Theolympic[dot]nl?Theolympicstandard[dot]biz?Usolympicsnews[dot]com?Vrolympics