topic Hello Norix, in Network Security

Signature to detect DNS Tunneling - SourceFire

Norix S — Fri, 21 Feb 2020 13:54:27 GMT

Experts,

I have gone through some recent vulnerabilities document from cisco and came to read a topic on DNS Tunneling & an Application tool that may perform such activity - DNScapy.

DNScapy is a DNS tunneling tool. The code is very light and written in Python. It includes a server and a client. The server can handle multiple clients.

DNScapy creates an SSH tunnel through DNS packets. SSH connection, SCP and proxy socks (SSH -D) are supported. You can use CNAME records or TXT records for the tunnel. The default mode is RAND, which uses randomly both CNAME and TXT.

DNScapy uses Scapy (http://www.secdev.org/scapy) for DNS packet forging and for his network automation API.

Now, on the preventive end, is there any Signature Cisco may want to release for IPS & Sourcefire units?

Is there any measures Cisco suggest we could implement from within the device?

Thanks!

Norix S.

Hello Norix,

Matthew Franks — Tue, 30 Aug 2016 14:04:47 GMT

Hello Norix,

Thank you for your comment. I believe this is in the wrong forum to get the proper assistance. Please try posting this to the Snort Rule Coverage rather than AMP as this will allow the proper personnel to address the issue.

Thanks,

Matthew Franks

ENGINEER, CUSTOMER SUPPORT

FirePOWER TAC

Frank

Norix S — Tue, 30 Aug 2016 23:58:36 GMT

Frank

Noted on the correction.

Thanks

anyone care to share their

Norix S — Thu, 01 Sep 2016 03:03:21 GMT

anyone care to share their thoughts on this?

I too have the same question

paulturn — Mon, 28 Nov 2016 10:29:49 GMT

I too have the same question guys, any update ?

Thanks in advance.

Re: Signature to detect DNS Tunneling - SourceFire

rick11 — Thu, 21 Sep 2017 12:15:41 GMT

Did you find any solution?
Thank you