New malware abuses DNS over HTTPS

The first ever malware strain seen that abuses DNS over HTTPS (DoH) protocol has been discovered by Netlab. Security researchers from Netlab, a network threat hunting unit of Chinese cyber-security giant Qihoo 360 made this discovery.

The malware, named Godlua, was detailed in a report published on Monday by the company’s researchers.

According to the Netlab team, Godlua is a malware strain written in Lua, which acts like a backdoor on infected systems. It’s written to work on Linux servers, attackers are using a Confluence exploit (CVE-2019-3396) to infect outdated systems, and early samples uploaded on VirusTotal have mislabeled it as a cryptocurrency miner.

But Netlab researchers say the malware actually works as a DDoS bot and they’ve already seen it being used in attacks, with one aimed against liuxiaobei.com, the homepage of a Liu Xiaobei fan site.

Malware abuses DNS over HTTPS to avoid passive DNS monitoring

Researchers say they’ve spotted two Godlua versions so far, with a somewhat similar architecture. Both versions used DNS over HTTPS requests to retrieve the TXT (text record) of a domain name, where the URL of a subsequent command and control (C&C) server was being stored, and to which the Godlua malware was supposed to connect for further instructions.

This technique of retrieving the URL addresses of second/third stage C&C server from DNS text records isn’t new. The newness here is the usage of a DoH request instead of a classical DNS request.

As the protocol’s name clearly states, DNS over HTTPS works by sending DNS requests via an encrypted HTTPS connection, rather than using a classic plaintext UDP request.

The DoH (DNS over HTTPS) request is encrypted and invisible to third-party observers, including cyber-security software that relies on passive DNS monitoring to block requests to known malicious domains.

Looming problem for cyber-security community

The discovery that Godlua abuses DNS over HTTPS to hide DNS traffic sent shockwaves through the cyber-security community this week, with many reacting on both Twitter [1, 2] and Reddit.

Spoiler: there will be more. Lots, lots more. DoH is going to break a lot of security controls. https://t.co/Eo8QqP3Mmd

— Kevin Beaumont (@GossiTheDog) July 2, 2019

DNS requests aren’t the only IOC, but they’re leaned-on heavily.

— Wesley McGrew (@McGrewSecurity) July 3, 2019

Many have expressed fears that other malware strains will now also adopt this feature, rendering a large chunk of cyber-security products that rely on passive DNS monitoring useless.

Their fear is justified; however, the cyber-security community has always found workarounds to any tricks malware employs, and it’s expected they’ll find one to deal with any strains that use DoH, as well.

More info on the DoH protocol can be found in the Internet Engineering Task Force’s (IETF) document RFC 8484.

Major browsers like Firefox and Chrome already support DoH. Last month, Google announced DoH support for its public DNS service, which the company provides for free to users in countries where governments are filtering and blocking internet traffic based on passive DNS monitoring.

Source: ZDNet

Be sure your PC Security is up-to-date and find the best ways to block malware and advertisements safely.