"Random subdomain query attack"

A Former User

Hi,

I have been informed today that my internet connection has been misused for a "random subdomain query attack".

As I am using pfSense for not too long time now, I would like to know if there are certain security settings I need to check to prevent the pfSense DNS Resolver to be misused (in case that is possible).

I didnt find anything related to this which could help me.

Anybody here can?

Thanks.

KOM

A random subdomain query attack is usually performed by a botnet that overwhelms a domain's DNS servers with bogus subdomain lookup requests. Do you have any client PCs behind your firewall that might be part of such a botnet?

cmb

Probably either have your WAN firewall rules way too wide open, allowing TCP/UDP 53 to the WAN IP, or a port forward allowing access to the DNS forwarder.

A Former User

Thanks for your replies.

I will verify both. If the rules would be too wide open (I did not explicitly give access to 53, so it should be closed).

johnpoz

Then it points to something on your client side doing the attack like cmb mentions. I would do a simple sniff on pfsense both lan and or wan interfaces - what do you see for dns traffic on udp and or tcp 53.. This will allow you to track down where the traffic is coming from, either the pfsense box itself or client.

I agree these sorts of attacks are normally from botnets, which the bot just targets its dns, so if you have a compromised client inside pfsense, it would be asking pfsense for the random.somedomain.tld, which pfsense then does the query for..

A Former User

Thanks for your replies. I scanned our Windows-Client and removed two suspicious files. I scheduled a reinstallation for this system.

fsansfil

Also, dont forget that malforged/attack packet can query on different port/protocol. Did your ISP specify port 53 or just query?

One example is DNS query hidden in ICMP. You can try a snort/suricata rule like this on the WAN just to diagnose…

alert icmp any any -> $HOME_NET any (msg:"DNS Query Hidden in ICMP"; content:"|01 00 00 01 00 00 00 00 00 00|"; offset:8; metadata:policy balanced-ips drop, policy security-ips drop; classtype:policy-violation; sid:99998888; rev:1;)

F.