Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Play Your Cards Right: Detecting Wildcard DNS Abuse

Summary: Palo Alto Networks' Unit 42 describes a detection system that uses passive DNS data and whois filtering to flag domains abusing wildcard DNS records, and reports identifying over 4,000 such domains in the weeks it has run the detector. The flagged domains were tied to questionable SEO campaigns and sites promoting gambling, adult content, or questionable video streaming, with some cases involving networks of dozens to thousands of domains sharing an identical layout.

What's compelling: Wildcard records let an attacker point a nearly infinite number of domain names at malicious hosts, and the domains are treated as disposable with short lifespans, so blocklists keyed to individual names will keep falling behind. The detector's own findings - over 4,000 abusive domains in a matter of weeks - show how much of this infrastructure sits in plain sight behind records that look like ordinary DNS administration.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related