Skip to main content

Malware increasingly using DNS as C&C channel to avoid detection

posted onFebruary 29, 2012
by l33tdawg

The number of malware threats that receive instructions from attackers through DNS is expected to increase, and most companies are not currently scanning for such activity on their networks, security experts said at the RSA Conference 2012 yesterday.

There are many channels that attackers use for communicating with their botnets, ranging from traditional ones like TCP, IRC and HTTP to more unusual ones like Twitter feeds, Facebook walls and even YouTube comments.

Most malware-generated traffic that passes through these channels can be detected and blocked at the network level by firewalls or intrusion prevention systems. However, that's not the case for DNS (Domain Name System) and attackers are taking advantage of that, said Ed Skoudis, founder of Counter Hack Challenges and SANS fellow, during a presentation on new attack techniques at the conference.

Source

Tags

Viruses & Malware DNS Security Networking

You May Also Like

Recent News

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th

Friday, June 7th

Thursday, June 6th