DNS sinkhole & Analysis

What is DNS sinkhole?

A sinkhole is a standard DNS server that has been configured to hand out non-routable addresses for all domains in the sinkhole, so that every computer that uses it will fail to get access to the real website.
 The higher up the DNS server is, the more computers it will block. Some of the larger botnets have been made unusable by TLD sinkholes that span the entire Internet.
DNS Sinkholes are effective at detecting and blocking malicious traffic, and used to combat bots and other unwanted traffic.

A sinkhole does not need to be a large DNS server, it only needs to be in the DNS lookup chain. The local hosts file on a Windows, Unix or Linux computer is checked before DNS servers, and can also be used to block sites in the same way.

Example of Sinkhole Alert.

ET TROJAN DNS Reply Sinkhole - Anubis - 195.22.26.192/26

SRC: 195.22.26.248 DST:10.101.8.116 ET TROJAN AnubisNetworks Sinkhole SSL Cert lolcat - 195.22.26.192/26

Findings of Sinkhole Alert

The time stamps on the above alerts coincided with each other with time stamps. 
Alert #1 would appear first in Snort then 
Alert # 2 would appear. 

It was at this point I decided to run a packet capture with Wireshark on the DNS server since that was the only consistent IP address listed on the Snort logs. The Wireshark PCAP revealed the following raw data, (please note the PCAP from Snort revealed the same information). This data was being communicated over port 443.

Now upon first looking at the PCAP it appears to be a file named invalid.cab, which is incorrect. What is actually happening is the PC is using the domains of ns2.csof.net and ns1 for DNS resolution, and attempting to reach invalid.cab. For those who are not up to date .cab is a new top level domain, the same as .com or .net. Leveraging some very simple domain tools available on the internet I was able to get a list of all sites listed under ns2 & ns1. One of the sites listed was ***https:/****/invalid.cab***

We now have a portion of the mystery solved. The PC’s are attempting to access a website named

***https:/****/invalid.cab***, which is why we were seeing port 443 being the communication port. Generally the bad guys like to obfuscate what they are doing, so I am assuming that is why the site was being run over 443 with https. The next question is why are we seeing Anubis Network sinkhole in the IDS alert? Simple; Anubis Networks a security firm has taken control over the infected domain.

Any traffic destined for original malicious domain invalid.cab is being redirected to the safe domain at Anubis Networks, lucky for us! The next question; what is infected on our network? Our network is heavily segregated; subnet traversal is not an option for the PC’s. I had ruled out a worm like infection. We are currently running Sophos UTM, which was detecting no infections on the network.

We also have content filtering on all machines through Sophos. The content filter detected no machines attempting access to invalid.cab, which lead me to believe that a majority of the machines tripping the IDS were not actually infected. Next I looked at our Sophos UTM console for machines with policy issues. That is when I found it, a machine that was unable to update its policies. I immediately pulled the machine off of the network. The IDS alerts stopped immediately.

I am currently running Combofix on the suspect machine to pull a valid sample infection from the machine, to submit to Sophos. My suspicion is Sophos will already have the sample in their database, but due to the fact the machine could not push any policy updates is why the machine failed to detect anything, but I would rather be safe than sorry. While Google searching the DNS domains of ns1 & ns2 it appears the infection is related to a Zeus Trojan.

This leaves one final question, why were so many PC’s trying to access that domain. The only conclusion I could draw is the infected machine was somehow attempting to poison our DNS server DNS results. Our Snort IDS is new, which is actually part of the Security Onion IDS; I have currently been tuning Security Onion over the last month, and can clearly see the value of it. This leads me into my final point. Antivirus and Firewalls are not enough, your network no matter how small it is needs and IDS.

The IDS will give you a deep understanding of what is actually going on inside your network. Without the Security Onion IDS I would have never known about the Trojan inside my network. Luckily for us the Trojan domain had already been sinkholed, but what if it hadn’t and we didn’t have the IDS? A scenario like this could be absolutely disastrous to a network. The closes example to this type of scenario is a million dollar house with its doors unlocked in the bad part of town. An IDS will take lots of work, from setup, tuning, to monitoring, but anything worth doing is never easy.

I hope this article will prove useful and helpful to others.

Reference : https://community.spiceworks.com/topic/887257-very-confusing-ids-alert