Outsmarting Cyber Sinkholes: Is It Possible?
By Tom Seest
Can Cyber Sinkholes Be Avoided?
At BestCybersecurityNews, we help entrepreneurs, solopreneurs, young learners, and seniors learn more about cybersecurity.
Sinkhole is an acronym that refers to two strategies used to protect against malware attacks by intercepting and monitoring all of the traffic that passes between compromised devices.
DNS sinkholes work by intercepting any attempts to connect to known botnet command and control (C2) servers with fake IP addresses controlled by administrators; this redirects attacks back into an administrator-managed server instead. ISPs and domain registrars often employ this technique on an infrastructure level, while system administrators or those with administrative privileges can modify their host files to achieve similar effects.
Can Cyber Sinkholes Be Avoided?
Table Of Contents
What Lurks Beneath Botnets?
Botnets are networks of infected computers controlled by malicious malware that engage in automated behaviors on the Internet, such as clicking ads, posting automatically generated comments or votes on social media, stealing software copyright information stored on computer systems, or even performing other attacks such as ransomware or password theft. BotMasters oversees this network.
One effective method of creating cyberspace sinkholes is blocking botnets from communicating with their Command and Control (C&C) servers through DNS sinkholing – intercepting outbound DNS requests directed towards malicious domains and redirecting them to servers offering non-routeable addresses, thus preventing bots from connecting to C&C servers while providing security experts an opportunity to analyze their behavior.
Another way of creating an impenetrable cyberspace environment is through creating a honeypot. Honeypots are devices used as bait for bad actors and allow security teams to observe their activity. A honeypot can either be deployed online or locally and features both hardware and software components that will lure malicious bots into an attack and record its actions for further analysis by security teams.
Sinkholes can also be created using DNS servers that will intercept traffic to malicious domains and divert it to non-routable IP addresses – this prevents infected hosts from communicating with their C&C server and can help decapitalize botnets.
Shadowserver, a free service offering daily live feeds of infected machines, has played an instrumental role in dismantling numerous botnets. Working alongside law enforcement agencies such as the FBI and other law enforcement organizations, it has helped gain control of key resources powering vast malware empires; particularly notable is Shadowserver’s work during Avalanche spam botnet takedown, Rustock malware botnet takeover, and Gameover seizure, which were all recognized by cybersecurity professionals.
Researchers can create a sinkhole in cyberspace by redirecting a botnet’s domain to one they control, enabling them to analyze its traffic and gain insight into how criminals run their empires. Researchers have employed this strategy effectively in stopping the Hlux and Kelihos botnets by taking control of their domain and forcing compromised computers to connect to fake C&C servers instead.
What Lurks Beneath Botnets?
How Denial-Of-Service (Dos) Attacks Could Create a Cyber Sinkhole
Denial-of-service attacks render websites and services unavailable to legitimate users by flooding them with an overwhelming volume of forged packets from infected computers or Internet of Things devices. A cyber attacker can make websites or applications unavailable by manipulating network packets, exploiting programming vulnerabilities, exploiting programming logical vulnerabilities or resource vulnerabilities, and more.
Sinkholes can help neutralize distributed denial-of-service (DDoS) attacks by identifying the server controlling a botnet, redirecting all traffic directed toward this server to an artificial honeypot – typically done using DNS, firewall, or on-prem applications like security incident response platforms – then analyzing its traffic to determine the attacker’s identity and method.
Establishing a sinkhole can also help organizations identify compromised hosts inside their network. For instance, they could utilize internal DNS servers to redirect all outbound requests to suspicious IP addresses to a sinkhole server, like a honeypot. This allows any suspicious traffic that enters to be processed through this decoy server before being evaluated for signs of malware infections.
Detection can also occur through DNS database changes: for instance, if an adversary uses an invalid IP address to connect to their Command and Control (C&C) server, this can be identified by changing its public IP address and redirecting all infected machines (zombies) within their botnet to a research server that will log traffic for analysis before sending results back to its owner.
Sinkholes can also be used to shield targets from attack by creating an interloper between two conniving laptop-class adversaries. For example, should one of the sink node’s private keys leak, this may allow its neighbor to impersonate it – then use authenticated messages sent through that node to connect to its attacker on another continent.
How Denial-Of-Service (Dos) Attacks Could Create a Cyber Sinkhole
Exploiting Cyber’s Sinkhole: What’s at Risk?
Sinkholes are openings in the ground that drain away all that flows beneath them, while cyber exploitation refers to activities that take advantage of people or organizations to gain access, profit from, or damage information systems – this may include data breaches, ransomware attacks, or any other malicious acts.
Exploitation can occur in real-life settings as well, particularly among children and young people, when someone gains control of their personal details or finances. This practice, known as child sexual exploitation (CSE), can involve physical, emotional, and financial abuse – with one incident happening after another – with no clear way out for victims.
Threat actors employ DNS sinkholes as an effective method of redirecting would-be victims of cyber attacks, such as phishing attacks and other forms of intrusion to websites under their control. This tactic has proven particularly successful when targeting high-profile targets such as government agencies or large companies; hackers then utilize compromised hosts within these organizations to gain additional footholds inside and infiltrate additional systems within.
DNS sinkholes work by cutting off communication between website domain names and their IP addresses, effectively shutting down botnets by stopping their hijacked computers from communicating with command and control (C2) servers. Cutting these connections also enables security professionals to gather logs of devices that attempt to connect to malicious sites – an invaluable way of tracking infected devices.
Many internet service providers and domain registrars set up DNS sinkholes to protect their clients, redirecting requests for malicious domains to IP addresses they can monitor and block. Network and system administrators may also create internal DNS sinkholes to redirect employees away from browsing unsafe websites by redirecting them to safer web properties; this approach may be more reliable than using external services for this task.
An independent DNS sinkhole may lack alerting capabilities, which can become problematic if its database becomes inaccurate or it detects false positives. Therefore, it is advisable to utilize software or services that provide this capability – Layer 7 next-gen firewalls offer such features, which make them more dependable solutions than homegrown solutions.
Exploiting Cyber’s Sinkhole: What’s at Risk?
What Can We Learn from the ‘Cyber Sinkhole’?
DNS sinkholes are used by cybersecurity professionals to detect cyber attacks and other malware activity. They work by redirecting DNS traffic away from its original domain name server, so when users try to visit, they are taken elsewhere instead. Furthermore, sinkholes are useful tools for collecting traffic data that can then be analyzed for patterns or trends of criminal behavior.
The DNS sinkhole technique can be used to intercept connections from botnets, denial-of-service (DoS) attacks, or any other form of cybercrime. You can set one up using open source tools like DNSmasq or more complex software solutions; especially effective is tracking down malware command and control servers to block them later.
To create a DNS sinkhole, administrators will compile a list of known malicious domains and IP addresses and configure their DNS server so as to respond with incorrect or nonexistent IP addresses for these queries. This will cause devices that attempt to connect to these malicious websites to instead connect to an unreachable dead-end server, which can then be monitored and examined for evidence of a cybercrime.
One way a DNS sinkhole can be deployed effectively is through honeynets, simulated networks designed to attract attacks. By creating multiple virtual servers to form such an attack-eliciting honeynet, attackers’ activities can be recorded and studied for insights into their methods and tactics – providing security experts with opportunities to neutralize attacks or prevent future ones.
One strategy used by adversaries to counter DNS sinkholes is spoofing the routing protocol used to connect with their C&C server, inducing their victims through compromised nodes that use breadth-first spanning tree routing algorithms.
AnubisNetworks lays claim to having the world’s largest sinkhole infrastructure and is widely utilized for malware analysis. Telemetry from around the globe is collected to track infections and their variants – providing useful insight into future attacks as well as which threats are most prevalent across specific geographies and industries.
What Can We Learn from the ‘Cyber Sinkhole’?
Please share this post with your friends, family, or business associates who may encounter cybersecurity attacks.