DNS cache poisoning, 4004

[mhellman]

Can we get some details on what this signatures is looking at? Does it do anything more intelligent than look at query throughput? I'm thinking something more along the lines of these Snort rules:

#by many very smart people

# This may be a high load sig. Take time and seriously consider

# that your dns_servers var is set as narrowly as possible

alert udp any 53 -> $DNS_SERVERS any (msg:"ET CURRENT_EVENTS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt"; byte_test:2,>,0,6; byte_test:2,>,0,10; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008446; rev:8;)

#this will catch large numbers of nxdomain replies, a sign that someone may be trying to poison you

alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive NXDOMAIN responses - Possible DNS Poisoning Attempt Backscatter"; byte_test:1,&,128,2; byte_test:1,&,3,1,relative; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008470; rev:1;)

[wsulym]

4004 just looks for a flood basically. In s347, we're making that pps rate visible. That number is currently set at 500.

I will say that dns responses with more than 1 RR are completely normal and happen all the time. I was watching some of my own dns traffic and I was getting responses with multipl RRs from things like Yahoo, Google CNN... completely normal and legitimate, nothing odd about it.

Does honing in on that make a sig any more specific - not really - its still a flood. Its the rate thats the kicker and what works for small shops, doesn't work for large shops - so you do have to have some handle of what you "normally" see. I'm not saying that looking for more might not be something that's useful, but it'll largely depend on what you normally see.

The traffic itself is legitimate, albeit crammed with bogus data.

[mhellman]

Thanks for the response.

None of the sigs are perfect, but it seems to me that the RR flood would likely be a better indicator of this than a query flood.

[attmidsteam]

At many of our busier/larger customers, this signature was a bit noisy (enough that we had to turn it off). The snort rules seem a bit smarter about detecting an attack than simply triggering on a rate.

[mhellman]

same here.