Monday, February 12, 2018

Using malware's own behavior against it

A quick read for a Monday night.

Last week while investigating some noisy events in my security monitoring system, I noticed two competing Windows features filling up event logs: link-local multicast name resolution (LLMNR) put lots of name resolution requests onto the local network segment, which Windows firewall promptly blocked.

LLMNR is the successor to NetBIOS Name Service. Both serve the same purpose: if a computer cannot resolve a name through DNS, it essentially yells out on the local network "hey, anyone know an address for xyzzy?" 

This sounds like a reasonable solution, but it invites abuse. If an adversary has a foothold on my network, they can either listen for and reply to common typos, or can actively interrupt the legitimate DNS and instead give their own answers. In either case, the adversary can provide fake addresses for servers and websites, directing users to malicious places (and possibly stealing usernames and passwords along the way).

Generally speaking, I recommend turning off LLMNR and NBNS, as well as using a trusted DNS provider that prevents access to known-malicious websites.

Today I came across a slick way to use such malware's own behavior against it. LLMNR "responder" malware replies to requests with a bogus address, so they generally respond to *any* request. So Respounder spits out bogus name requests and looks for responses.

Do you have something to add? A question you'd like answered? Think I'm out of my mind? Join the conversation below, reach out by email at david (at) securityforrealpeople.com, or hit me up on Twitter at @dnlongen

Whois David?

My photo

I have spent the better part of two decades in information technology and security, with roots in application developer support, system administration, and network security. My specialty is cyber threat intelligence - software vulnerabilities and patching, malware, social networking risks, etc. In particular, I strive to write about complex cyber topics in a way that can be understood by those outside the infosec industry.

Why do I do this? A common comment I get from friends and family is that complex security topics give them headaches. They want to know in simple terms how to stay safe in a connected world. Folks like me and my peers have chosen to make a profession out of hacking and defending. I've been doing this for the better part of two decades, and so have a high degree of knowledge in the field. Others have chosen different paths - paths where I would be lost. This is my effort to share my knowledge with those that are experts in something else.

When not in front of a digital screen, I spend my time raising five rambunctious teens and pre-teens - including two sets of twins. Our family enjoys archery, raising show and meat rabbits, and simply enjoying life in the Texas hill country.

For a decade I served as either Commander or a division leader for the Awana Club in Dripping Springs, Texas; while I have retired from that role I continue to have a passion for children's ministry. At the moment I teach 1st through 3rd grade Sunday School. Follow FBC Dripping Springs Kids to see what is going on in our children's ministries.