CIRA and Nominum offering DNS firewall
Canadian ccTLD registry CIRA has started offering DNS-based security services to Canadian companies.
The company has partnered with DNS security services provider Nominum to develop D-Zone DNS Firewall, which it said lets customers “block access to malicious content before it can reach their network”.
It’s basically a recursive DNS service with a layer of filterware that blocks access to lists of domains, such as those used by command and control servers, known to be connected to malware and phishing.
It’s a timely offering, given the high-profile WannaCry ransomware which infected hundreds of thousands of unpatched Windows boxes worldwide last month (though I’m not sure this kind of service would have actually prevented its spread).
The CIRA service uses Nominum’s technology but operates at Canadian internet exchange points and appears to be marketed at Canadian customers.
It’s the latest effort by CIRA to expand outside of its core .ca registry business. Earlier this year, it became ICANN’s newest approved gTLD back-end provider after a deal with .kiwi.
Many ccTLD registries are looking outside of their traditional businesses as the increasingly cluttered TLD market puts a squeeze on registration growth.
Massive ransomware attack hits 150 countries, brought down by a domain reg
A massive outbreak of malware on Friday hit thousands of organizations in an estimated 150 countries and had a big impact on the UK National Health Service before being temporarily thwarted by a single domain name registration.
WannaCry, as the malware has been called, targets Windows boxes that have not installed a March security patch. It encrypts files on the hosts it infects and demands money for the decryption key.
The attack is Big News for several reasons.
First, it spread ransomware over the network using a remotely exploitable vulnerability that required no user error or social engineering to install itself.
Second, it hit an estimated quarter-million machines, including thousands at big organizations such as Telefonica, the NHS, Deutsche Bahn and FedEx.
Third, it posed a real risk to human life. A reported 70,000 NHS machines, including medical devices, were said to be infected. Reportedly, some non-critical patients had to be turned away from UK hospitals and operations were cancelled due to the inability of doctors to access medical records.
Fourth, WannaCry appears to have been based on code developed by the US National Security Agency and leaked last month.
All in all, it was an attack the scale of which we have not seen for many years.
But it seems to have been “accidentally” prevented from propagating further on Friday, at least temporarily, with the simple act of registering a domain name.
A young British security researcher who goes by the online handle MalwareTech said he was poring over the WannaCry code on Friday afternoon when he came across an unregistered domain name.
On the assumption that the malware author perhaps planned to use the domain as a command and control center, MalwareTech spent the ten bucks to register it.
MalwareTech discovered that after the domain was registered, the malware stopped encrypting the hard drives it infected.
He first thought it was a fail-safe or kill-switch, but he later came to the conclusion that the author had included the domain lookup as a way to thwart security researchers such as himself, who run malware code in protected sandbox environments.
MalwareTech wrote:
In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as [if] it were registered
Once the domain was registered, WannaCry iterations on newly infected machines assume they were running in sandboxes and turned themselves off before causing additional damage.
MalwareTech was naturally enough proclaimed the hero of the day by many news outlets, but it appears that versions of the malware without the DNS query kill-switch already started circulating over the weekend.
Many are warning that the start of the work week today may see a new rash of infections.
The researcher’s account of the incident can be read in full here.
Recent Comments