{"id":42092,"date":"2018-04-18T04:00:00","date_gmt":"2018-04-18T04:00:00","guid":{"rendered":"https:\/\/www.cira.ca\/blog\/weekly-web-security-warning-a-focus-dns-tunneling\/"},"modified":"2023-03-10T10:57:07","modified_gmt":"2023-03-10T15:57:07","slug":"weekly-web-security-warning-a-focus-dns-tunneling","status":"publish","type":"cira_news","link":"https:\/\/www.cira.ca\/en\/resources\/news\/cybersecurity\/weekly-web-security-warning-a-focus-dns-tunneling\/","title":{"rendered":"Weekly web security warning – a focus on DNS tunneling"},"content":{"rendered":"

Every week, we examine the top trends in malicious activity we have seen in Canada using data obtained through CIRA’s D-Zone DNS Firewall.<\/p>\n

<\/p>\n

The top blocked domains this week is a virtual carbon-copy of last week’s list. If you’re unfamiliar with some of the threat types, you can read their definitions in last week’s post<\/a>.<\/p>\n

Of note this week is that there are three .ru (the Russian ccTLD) domains all related to Trojan downloaders that are used to deliver payloads to machines unlucky enough to be infected. These don’t necessarily always come through a click on a bad link but can be distributed along with other software like legitimate games or other programs that are downloaded online. It is an important lesson about being careful where you download from.<\/p>\n

Top ten domains blocked last week<\/h2>\n
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Domain Name<\/strong><\/p>\n<\/th>\n

\n

Threat Type<\/strong><\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

superyou.zapto.org<\/p>\n<\/td>\n

\n

Spybot<\/p>\n<\/td>\n<\/tr>\n

\n

76236osm1.ru<\/p>\n<\/td>\n

\n

Trojan downloaders<\/p>\n<\/td>\n<\/tr>\n

\n

dj1.jfrmt.net<\/p>\n<\/td>\n

\n

Morto<\/p>\n<\/td>\n<\/tr>\n

\n

api-restlet.com<\/p>\n<\/td>\n

\n

Xavier<\/p>\n<\/td>\n<\/tr>\n

\n

dzhacker15.no-ip.org<\/p>\n<\/td>\n

\n

Hworm<\/p>\n<\/td>\n<\/tr>\n

\n

brenz.pl<\/p>\n<\/td>\n

\n

Suspected malware<\/p>\n<\/td>\n<\/tr>\n

\n

soplifan.ru<\/p>\n<\/td>\n

\n

Trojan downloaders<\/p>\n<\/td>\n<\/tr>\n

\n

diplicano.ru<\/p>\n<\/td>\n

\n

Trojan downloaders<\/p>\n<\/td>\n<\/tr>\n

\n

ns6.wowrack.com<\/p>\n<\/td>\n

\n

Mirai<\/p>\n<\/td>\n<\/tr>\n

\n

ns5.wowrack.com<\/p>\n<\/td>\n

\n

Mirai<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/figure>\n

Operating a public Wi-Fi network? Be aware of DNS tunnels<\/h2>\n

We took a look at DNS tunnel activity and this one is of particular interest to anyone operating a public Wi-Fi network, typically found at public spaces such as schools, municipalities and hotels. Among D-Zone DNS Firewall users with public networks, we see a high prevalance of DNS tunnel attempts. DNS tunnels can be used to go around paid Wi-Fi or login-based Wi-Fi<\/a>. Blocking these queries is therefore quite important to those operating a public Wi-Fi service.<\/p>\n

\n

Tunnels<\/h3>\n

\"\"

\n

The total number of queries is hidden from this chart, but we see that they are highly related to a common theme of domains (.in).<\/p>\n<\/figcaption><\/figure>\n

\n

Learn more about D-Zone DNS Firewall<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Every week, we examine the top trends in malicious activity we have seen in Canada using data obtained through CIRA’s D-Zone DNS Firewall.<\/p>\n","protected":false},"featured_media":1949,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"ngg_post_thumbnail":0,"slim_seo":{"title":"Weekly web security warning - a focus on DNS tunneling - CIRA","description":"Every week, we examine the top trends in malicious activity we have seen in Canada using data obtained through CIRA's D-Zone DNS Firewall. The top blocked domai"},"footnotes":""},"topic":[28],"class_list":["post-42092","cira_news","type-cira_news","status-publish","has-post-thumbnail","hentry","cira_news_type-cira-news-type-blog","cira_topic-cira-topic-cybersecurity","cira_author-rob-williamson"],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.cira.ca\/en\/wp-json\/cira\/v1\/news\/42092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cira.ca\/en\/wp-json\/cira\/v1\/news"}],"about":[{"href":"https:\/\/www.cira.ca\/en\/wp-json\/wp\/v2\/types\/cira_news"}],"version-history":[{"count":0,"href":"https:\/\/www.cira.ca\/en\/wp-json\/cira\/v1\/news\/42092\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cira.ca\/en\/wp-json\/wp\/v2\/media\/1949"}],"wp:attachment":[{"href":"https:\/\/www.cira.ca\/en\/wp-json\/wp\/v2\/media?parent=42092"}],"wp:term":[{"taxonomy":"cira_topic","embeddable":true,"href":"https:\/\/www.cira.ca\/en\/wp-json\/cira\/v1\/topic?post=42092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}