In our ongoing series exploring the Department of Defense’s Continuous Authorization to Operate (cATO) model, we now turn our attention to two critical components: the Secure Software Supply Chain (SSSC) and DevSecOps practices. These elements form the backbone of a robust cATO implementation, ensuring both security and agility in software development and deployment.
Continuous Authorization to Operate (cATO) is changing the way organizations approach cybersecurity and compliance in dynamic IT environments. By embedding security directly into development and operational workflows, cATO enables real-time assessment, assurance, and authorization, promoting agility without compromising security. An environment with effective personnel and processes is critical to achieving the intended goals and objectives of a cATO.
As software systems grow increasingly complex and interdependent, static and periodic compliance assessments fall short of ensuring security. Threats evolve faster than traditional systems and accreditation processes can adapt, creating vulnerabilities or weaknesses in the software supply chain and operational lifecycle.
The cATO approach addresses these challenges by shifting from static, point-in-time approvals to a dynamic, continuous assessment and authorization model. This shift requires integrating SSSC and DevSecOps as critical enablers of security, resilience, and agility.
The software supply chain encompasses all components, dependencies, and processes involved in developing, deploying, and maintaining software applications. A compromised supply chain can lead to breaches that affect downstream systems, organizations, and even national security, as seen in incidents like the SolarWinds attack (SolarWinds, 2021) and XY/libzma.
Key principles for securing the software supply chain include:
[1] https://github.com/tukaani-project/xz/commit/e93e13c8b3bec925c56e0c0b675d8000a0f7f754
DevSecOps integrates security into every stage of the software development lifecycle (SDLC), fostering a culture of “secure by design.” By automating security practices and embedding them into CI/CD pipelines, DevSecOps enables organizations to meet cATO requirements effectively.
Key DevSecOps practices include:
The intersection of SSSC and DevSecOps represents the synergy required for achieving cATO competency. Here’s how organizations can align these practices to enable secure, compliant, and resilient IT systems:
When organizations integrate SSSC and DevSecOps into their cATO strategies, they unlock several benefits:
As organizations navigate increasingly complex cybersecurity landscapes, the adoption of cATO frameworks, supported by secure software supply chains and DevSecOps practices, is no longer optional—it’s essential. By embedding security into every layer of development and operations, organizations can achieve continuous assurance and resilience while staying compliant with evolving regulations.
With the right combination of people, processes, and technologies, cATO empowers organizations to innovate securely, keeping pace with the demands of modern IT ecosystems.
References
Your quick reference guide to align enterprise cybersecurity with DoD’s shift to Zero Trust
Since its inception in 2010, Zero Trust Architecture has taken the cyber defense world by storm as a way to account for the evolving threat landscape and changing cloud and hybrid IT environments that function without a precise network perimeter. Consequently, over the last two years or so, there’s been an influx of strategic guidance, policy, execution roadmaps, and other cybersecurity risk management resources surrounding the Department of Defense’s (DoD) transformational shift to a “Zero Trust.”
As with many cybersecurity hot topics, the initiative is often laced with vast marketing promises and relentless attempts to communicate the ever-increasing need to buy a tool (“silver bullet”) to solve the problem or, in this case, get to Zero Trust security.
With the Department navigating the Zero Trust waters and unpacking the myriad of capabilities and activities necessary to formulate a robust implementation plan (due to the DoD CIO by October 2023), BreakPoint Labs offers clear, actionable steps for any organization to self-evaluate its current program and begin its journey towards achieving a Zero Trust Architecture.1
Avoid falling prey to the solicitation of purchasing a new, shiny Zero Trust capability, especially early on in the process. The DoD defines the Zero Trust baseline as one that “leverages its current infrastructure and environment using Brownfield approach.”
In other words, it retains key elements of the existing perimeter-based methodology and applies them within the modernized Zero Trust model. Considering the depth and breadth that consists of more than 45 capabilities and 152 activities that comprise the DoD Zero Trust Strategy, there’s ample opportunity to put existing investments to work within the new paradigm.2
A foundational step to Zero Trust is understanding who and what is on the network. At the most basic level, you can’t protect and defend components unmanaged or unaccounted for.
Establishing and validating a current, accurate inventory of all users, including person and non-person entities, is critical to ensuring those with access to resources are vetted and registered from an authoritative source.
In addition to users, organizations must inventory devices to validate what systems are authenticated, authorized, and connected to other network resources. While creating or verifying an inventory seems administrative, doing so in a trusted, standardized, and data-driven manner will pay dividends in the later stages of the Zero Trust journey.
With an understanding of who and what is on the network, an organization can designate Identity, Credential, and Access Management (ICAM) solutions to serve as an authoritative source for identities and subsequent authentication and authorization decisions.
Before the release of the Zero Trust Strategy in 2020, the DoD released an ICAM Strategy (if you’re seeking yet another strategy) focused on “the creation of digital identities and maintenance of associated attributes, credential issuance for person/non-person entities, authentication using the credentials, and making access management control decisions based on authenticated identities and associated attributes.”
The need for a well-defined and well-informed ICAM solution is apparent. It’s essentially the “quarterback” of the Zero Trust architecture responsible for many downstream decisions on user authentication and authorization.
A secure trusted environment where people and non-person entities can securely access all authorized resources based on mission need, and where we know who and what is on our networks at any time.
DoD ICAM Strategy – Vision
Like user identities, devices must also be pinpointed and inspected before accessing network resources. Ensuring systems are not only what they say they are but also verifying they satisfy a minimum baseline of vulnerability or patch management levels — letting you drastically reduce risk within the environment.
Comply-to-Connect (C2C) capabilities have advanced significantly in recent years, especially considering the increased use of remote access during and following the COVID-19 pandemic.
C2C allows for real-time inspection of devices and comprehensive policy decisions that best suit the needs of the organization and its users. A well-instrumented C2C solution will be a critical source for device authentication decisions.
With the foundational building blocks of a Zero Trust Architecture in place, organizations can begin to focus on interoperability, automation, and analytics. Using application programming interfaces (APIs), organizations can automate repetitive, predictable processes, including:
As Zero Trust implementations mature, organizations will transform into data-rich environments that conduct cybersecurity monitoring through various information logs such as user, device, applications, and network activity — offering limitless options for behavioral analytics to characterize, monitor, and continuously evaluate the enterprise cybersecurity posture.
The adoption of Zero Trust principles does not happen overnight. It takes careful, deliberate planning and continuous incremental improvements to execute the framework fully.
As DoD seeks to implement distinct Zero Trust capabilities and activities by Fiscal Year 2027, the Department’s own Zero Trust Portfolio Management Office has recognized the need to “make it simpler, while still maintaining the ability…to stop the adversary.”
The key considerations and actionable steps described will jumpstart any organization’s journey toward achieving a Zero Trust Architecture.
Disclaimer of Endorsement
The information and opinions contained in this document are provided “as is” and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise does not constitute or imply its endorsement, recommendation, or favoring by BreakPoint Labs, LLC.
1. DoD Zero Trust Strategy Placemats, retrieved from https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-StrategyPlacemats.pdf. ↩
2. DoD Zero Trust Capability Execution Roadmap, retrieved from https://dodcio.defense.gov/Portals/0/Documents/Library/ZTCapabilitiesActivities.pdf. ↩
As additive manufacturing (AM) matures and continues to gain popularity, it becomes an increasingly attractive target for cyberattacks. Therefore, being proactive in preparing for these security threats, particularly for high-value targets, is of paramount importance. A recently published paper [1] identifies the importance of developing and implementing a forensic readiness model to prepare for attacks on 3D printers. According to the paper’s authors, current forensic readiness models “do not consider AM processes and may be ineffective” for crimes that involve 3D printers, which motivated their work in developing a forensic readiness framework for AM.
The framework, which the authors refer to as the Forensic Readiness for Material Extrusion-based Printing Process (FRoMEPP), emphasizes the need to establish a “forensically ready” printing environment before an incident occurs in order to allow for the acquisition and preservation of relevant data as an attack is occurring, not after the attack subsides when data can be lost or overwritten. The different components of the framework are shown in Figure 1.
The authors identify several categories of cyber-domain information that are critical to monitor during an attack, including operating system logs, network logs, and application logs. These three log types cover a wide range of activities, from user account sessions and file access activities, to network traffic (e.g., SSH and HTTP connections), and finally to CAD and slicer software usage. By collecting and analyzing multiple logs, investigators can piece together the events of an attack with the assurance that the results of the investigation can be corroborated using multiple data sources.
Similar to investigations in other domains, the paper emphasizes that preserving and archiving evidence related to AM attacks is imperative. According to NIST IR 8387, “Digital Evidence Preservation” [2], digital evidence retention policies may vary between jurisdictions and organizations. However, in the absence of local statutes or policies, organizations should determine for themselves how long evidence should be preserved, which highlights the need for a flexible retention solution.
The proposed FRoMEPP framework [1] goes into much more detail and includes other critical aspects of the forensic readiness model, including the employment of out-of-band sensors and the selection of a suitable monitoring scheme. For the sake of brevity, we can’t cover the entire paper, but interested readers are encouraged to review the rest of the paper using the link in the footer.
Anticipating the demand for a security-hardened device that protects against cyberattacks on additive manufacturing machines, BreakPoint Labs has developed BISON to provide cutting-edge cyber defense capabilities in a small, convenient form factor. BISON captures critical cybersecurity information in the machine-to-machine communications between the controller and printer, and can ingest Windows security event logs and certain application logs for advanced analysis. This data is archived in the system until manually removed by an operator, ensuring that pertinent information is preserved for any post-incident investigations.
If you are interested in learning more about how BISON can secure your AM environment, please contact us at info@breakpoint-labs.com.
[1] https://www.sciencedirect.com/science/article/pii/S2666281723000112
[2] https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8387.pdf
Operational technology is rapidly becoming a target of ransomware operations due to the business impact of taking these essential systems down and how this pressure can lead to companies paying the criminals in order to restore operations. The manufacturing industry is making significant investments in AM hardware and materials (approximately $17B in 2021). The growth of capital in this technology will attract cyber criminals. This article examines the potential targeting approach that may be used by ransomware criminals to value a company’s assets, even those not on a network.
Suppose that a ransomware group decides that organizations who can afford 3D printing are good targets of ransomware due to the need to prepare print jobs through a Windows based engineer workstation. The group realizes that most CAD (computer aided design) capable computers are fairly expensive in addition to the expense of the additive manufacturing hardware. They can use open source intelligence (OSINT) gathering from a passive perspective. Once attackers gain access to your network, they can use the tools, etc. described in the following to enumerate these engineering workstations and the corresponding OT equipment, even those that are offline but rely on digital-thread dependent processes.
After some time, a phishing attempt goes through and access is gained to engineering workstations. Now they simply have to launch ransomware tools to encrypt the workstation, locking the end user from being able to use or recover their files. This is where a note is left with instructions on how to pay the group to unlock the computer, typically through a cryptocurrency transfer. The amount requested from a victim is a critical factor for achieving the ransomware group’s goals. If the amount is too high the victim will simply ignore the ransom and cut their losses. This is where a little homework post-phishing access and pre-encryption can pay off.
Some techniques to automate this asset research can be done using the command line to extract the pertinent information. First, the workstation itself is a valuable resource that needs to be taken into consideration when setting a ransomware value. In the example table above the Command MSInfo32 /report report.txt is used to get the make and model of the compromised AM Workstation.
Next up is researching OT resources. This is a little more difficult and requires more prep and background knowledge of the AM process. Many 3D printers lack network capabilities so one would think a remote attacker with zero physical access would struggle to determine what assets a manufacturer has. This is not the case. Running this hardware requires leaving “digital footprints” on the engineering workstation of these expensive, non-networked hardware items. One method to detect the OT hardware is to open and inspect the slicers, such as in the image below.
This method works but is time consuming and can be a step whereby the end user discovers the intrusion. A better solution is to again use the Command Line to gather this information for us in the background. A database containing the standard directories used by the most common slicing utilities and versions would be the best method to automate this task. The blind spot here is that non-networked assets do not have an instance number. For example, an AM operation could have 10 Taz Pro printers but only reflect one in the slicing utility / RoamingData.
The ability to detect and prevent this type of fact gathering intrusion extends a company’s security posture beyond protecting against ransomware. This post focuses on setting a monetary value for ransomware purposes but there are many other pivots an attacker could achieve with this information depending on their end goals. If they wanted to achieve destructive attacks on manufacturing they could use this information to create relevant attack strategies based on the available attack surface. If a machine is found to have G-code articulated stepper motor drivers those printers would be candidates for current overheating based attacks compared to machines that rely on trimpot physical adjustments. Knowledge stolen from the slicer configs also tells an attacker what firmware a device uses so they can research the developers and if open-source obtain a copy to maliciously modify for gaining persistence on a non-networked device. It will be easy to identify the transfer media (USB, SD card) based on the printer information to jump the “air-gap” to a resource that is supposed to be unreachable.
The impact of intellectual property theft in the prototyping / R&D phases where these AM assets are most leveraged is incredibly large. One of the best ways to protect or respond against this threat is to recognize that AM operations are at risk and the information to subvert these processes is widely available due to the reliance on open-source-software. This is amplified by the “insecure by design” equipment manufacturers tend to adopt as cybersecurity is not a topic in the development of physical manufacturing equipment. This leads to no native visibility into the environment from a security perspective. These facts fueled the development of BISON to gain the visibility needed to secure R&D / intellectual property during manufacturing stages.
If you are interested in learning more about securing AM or a demonstration of the BISON capability, please contact us at info@breakpoint-labs.com
Ref: Ginter, Andrew, and Greg Hale. “OT Security Incidents 2021 Trends and Analyses.” ICS STRIVE, 2022, pp. 4–4., Accessed 12 June 2022.
The growth of the Additive Manufacturing industry has yielded some exciting advancements in manufacturing. As AM is more widely adopted it is imperative that trust in AM parts is proven and retained. Having rigorous verification and validation processes in place will help ensure the quality of AM parts and maintain customer trust in AM technologies.
Verification is a process whereby objective evidence is used to demonstrate that a product is designed and manufactured according to its specifications and is free of defects. We are asking, “Did we build this thing correctly?”. Verification is a prerequisite for validation.
AM verification processes and techniques primarily focus on analyzing the post-manufactured object. Popular AM verification methods are X-ray technology, which can validate the internal geometry, and CT scanning, which quickly and accurately verify the internal and external geometry. CT scan results are then analyzed by creating a dataset and comparing it against a CAD file. This nondestructive x-ray technology is also capable of identifying internal cracks and porosity between the intersections of resins in multi-material printed parts. A CT scan offers a much higher level of detail than X-ray. Newer in-process verification methods focus on monitoring the print as it’s happening. These in-process monitoring techniques can utilize acoustics, visual and/or mechanical sensors. The collected data can then be visually inspected as well as digitally compared to the intended specifications. While these verification methods are an important part of verification and validation, there is a piece missing. When a part fails verification testing, we want to know why. While machine operations, machine parameters, design, material or user error may be to blame; however, we also need to assess whether any outside actor introduced a fault through cyber-enabled access.
Continuous cyber monitoring detects compliance and security risk issues in real-time. Through this continuous monitoring, sabotage to AM prints can be detected before going through expensive verification processes such as CT scanning. Continuous monitoring of cyber activity related to AM is especially important in applications where critical parts are being manufactured and also where national security could be at risk. In March 2022, The White House released a statement prioritizing the strengthening of cybersecurity defenses and improving the security of widely used technology in order to prepare our Nation for cyber threats. With BISON, continuous monitoring processes reconstruct the G-Code transmitted over the wire and compares that to the original, trusted file and identifies deviations. If deviations occur, AM operators will have insight into any malicious cyber activity that has occurred.
If you are interested in learning more about securing AM or a demonstration of the BISON capability, please contact us at info@breakpoint-labs.com.
The more things change, the more they stay the same. Ransomware attacks continue to disrupt organizations across all sectors while the results of law enforcement actions are waiting to be seen. We continue to monitor an effective threat group that shows no signs of slowing down.
The following domains were identified and attributed to this threat group:
| azuregroupusa.com | getprintservices.com | twebhost.com |
| chipfirmware.com | itacrobat.com | vip-source.com |
| databasegroupinc.com | mikrotikinside.com | webnofy.com |
| dmaorlando.com | release-app.net | webonlinecompany.com |
| easyupdatepro.com | slim-well.com | windows-upd.com |
| esc-ok.com | softlinesys.com | wmsmicro.com |
| eztechnet.com | sonyblueprint.com | |
| gdbcrew.com | spdevhost.com |
One positive note, we observed a distinct change in adversarial TTPs with this group in the past month. Threat actors have moved away from their preferred domain name registrar, NameCheap, to other providers like NetEarth One and Hosting Concepts B.V. d/b/a Registrar.eu.
The best defense against ransomware continues to be centered on reliable backups, active monitoring of networks and systems for vulnerabilities and weaknesses, and active patch management solutions. An ounce of prevention is worth a pound of cure. If your enterprise is missing one or more best practices, please contact us to help get you on the right track before it is too late.
If you are in need of incident response support or ways to defend against this and other threats, please contact us at https://breakpoint-labs.com/.
Since our last post at the end of August 2021, we have continued to track an effective ransomware group and they have been busy! We are tracking over 120 domains correlated to this threat group. They have been busy in October registering over 20 new domains in the last two weeks.
The following new domains have been linked to this threat group:
| academyads.com | emerictech.com | newseo.org | troncaselink.com |
| accountsupdate.org | escondidoseo.com | novadigitalgroup.com | turbojax.com |
| acronicssolutions.org | gessertmedia.com | ogsbd.com | uniselect.org |
| appinternet.net | get4tech.com | perscitech.org | unrigusa.com |
| av-sat.net | go-instant.com | phpjoblist.com | updatedlinux.com |
| bdeduinfo.com | herosoft.org | radardefence.com | updater-panel.com |
| bestupdate.net | hsncsoft.com | rdadev.com | us-time.org |
| cbdallas.org | ifftools.com | rootmailer.com | us-time.us |
| cloud-dock.net | introwebsites.com | router-manager.net | vpn-updates.net |
| cnetdownloader.net | ircontent.com | rq-technologies.com | wget-upd.com |
| codegemba.com | iweb-tech.com | shopyscripts.com | wiredobserver.com |
| codessional.com | jetkm.com | slot-download.com | wmi-technologies.com |
| competitionsites.com | metasportsystems.com | smlsystem.com | wotsafe.org |
| crmdevnet.com | mkvdb.com | sourangroup.com | zacstech.com |
| database-updater.com | msbackupservice.org | tebo-tech.com | zeoplan.com |
| datasecuritytoday.com | mysafexpress.com | tmdiagnostics.com | zoncat.com |
| devpda.com | new-release.net | top-enter.com | zorandev.com |
As you can see above, they continue to follow technology-related domain schemes. Each domain is hosted on a VPS with similar ports, protocols and services. During our analysis, we identified the actors running “Metasploit 4.20.0 – Update 2021083001” – a recent and likely cracked version of Metasploit.
This threat group is very active and has better tradecraft than other threat groups. The actors utilize non-standard ports, recently expired domains, employ trusted Let’s Encrypt certificates and do not reuse infrastructure to blend in with legitimate traffic that is not easily searchable. By proactively identifying their infrastructure we are able to prevent this threat and others like them from compromising our customers.
If you are in need of incident response support or ways to defend against this and other threats, please contact us at https://breakpoint-labs.com/.
During the course of multiple incident response engagements, we encountered a persistent, unknown ransomware threat group utilizing an obfuscated Golang encryptor
[1]. It is believed that the threat actors gained initial access through one or more SonicWall exploits [2], [3].
We can confirm prior sightings that Cobalt Strike was used by these threat actors to further gain access to exploit victim networks. In this blog, we will highlight previously unreported infrastructure that is managed by this unknown threat group.
Victims are presented with the following ransom note:
Hello dear user! Unfortunately, your files have been encrypted and attackers are taking over 300 GB of your personal data, financial reports and many other documents. Do not try to recover files yourself, you can damage them without special software. We can help you recover your files and prevent your data from leaking or being sold on the darknet. Just contact support using the following methods and we will decrypt one non-important file for free to convince you of our honesty. Contact us method below: Use TOR Browser: http://[redacted].onion/[redacted]
A recent sample of the Golang packed malware was submitted to VirusTotal in mid July 2021 [4]:
| MD5 | 864e4a109565f8d4052b959a12bfa45b |
| SHA-1 | 94388841e65c0962e56bf3e37391006d0af20bf4 |
| SHA-256 | d6f7eed7e8aeffb0683639a2c5b654d216f98a68de1528ef37685103f6e24550 |
The following domains have been attributed to the unknown threat group and have been observed hosting a Cobalt Strike server using TLS/SSL on non-standard ports. It is clear that these threat groups are attempting to blend in with the noise by generating seemingly legitimate domains.
| 3comnet.biz | cisco-network.org | group-policy.org | releases-upgrade.com |
| 3comnet.net | cisco-updates.com | ibgp-cisco.com | repository-buster.com |
| advmicrodevice.com | ciscodev.org | intelfirmware.net | routeros-update.com |
| amibios-updater.com | code-signing.org | juniper-firmware.com | serviceupdate.net |
| amibios.net | dev-repository.com | juniper-vpn.net | software-repository.com |
| apps-update.net | dev-service.org | junipervlan.com | software-updater.net |
| archive-update.com | dev.updatecore.net | mikrotikfirmware.com | ubiquiti-vpn.com |
| archives-firmwares.com | developmentsdata.com | mikrotikvpn.net | unattended-upgrades.net |
| bgp-firmware.com | dlinknetwork.com | nvme-updates.com | updatepayments.net |
| buster-updates.com | dlp-systems.org | poweredge-update.com | veeamdata.com |
| cisco-cloud.net | esxi-update.net | release-update.net | vpn-updater.com |
The following IP addresses are related to the domains listed above and appear to be a single use.
| 104.129.26.226 | 170.130.28.35 | 173.232.146.43 | 23.226.132.245 |
| 104.129.26.28 | 170.130.28.37 | 173.232.98.16 | 23.94.83.123 |
| 104.129.42.67 | 170.130.55.16 | 191.101.172.24 | 45.227.255.15 |
| 104.149.216.58 | 170.130.55.160 | 192.154.213.119 | 46.161.27.19 |
| 104.223.106.239 | 170.130.55.32 | 192.154.213.122 | 64.188.19.20 |
| 107.150.19.211 | 170.130.55.97 | 192.154.224.52 | 64.188.27.154 |
| 107.150.19.72 | 172.245.247.67 | 192.3.31.17 | 66.154.102.222 |
| 162.218.210.152 | 172.245.87.3 | 192.3.99.71 | 66.154.103.212 |
| 162.218.211.139 | 173.232.146.185 | 194.165.16.98 | 66.154.112.36 |
| 162.245.191.153 | 173.232.146.218 | 198.23.141.117 | 66.63.162.170 |
| 167.160.166.12 | 173.232.146.39 | 216.244.83.66 |
This threat group has been very active and if you or your organization utilized a SonicWall SMA VPN device since late 2020 or early 2021 without limited access, there is a likelihood that your organization has been compromised. If you observe any connections to the domains listed above, it is very likely you are compromised.
1. Back up (or start backing up!) all of your critical business data to an offline location. We observed these threat actors identifying backup solutions employed by a victim and removing all backup files from an online 3rd party solution provider.
2. Patch and upgrade your SMA devices immediately. More information can be found here: https://www.sonicwall.com/support/product-notification/urgent-security-notice-critical-risk-to-unpatched-end-of-life-sra-sma-8-x-remote-access-devices/210713105333210/
3. Review all SMA logs looking for suspicious activity – specifically looking for successful authentication attempts from non-US based IP addresses and/or IP addresses that don’t originate from Internet service providers such as home or commercial ISPs.
4. Enforce multi-factor authentication for all VPN accounts.
5. Employ signatures to detect the above mentioned domains and hashes.
If you are in need of incident response support or ways to defend against this and other threats, please contact us at https://breakpoint-labs.com/.
[1] https://www.crowdstrike.com/blog/new-ransomware-variant-uses-golang-packer/
[3] https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001
This video provides a crash course introduction to Linux for security analysts. It is common for security analysts to enter the field with their Linux skills lacking. Linux provides a security analysts with such powerful data analysis capabilities using built-in utilities (Grep, Sed, Awk, Egrep, Sort, Uniq, etc.).
This video hopefully gives someone new to Linux a few jumping off points by showing some useful examples (analyzing pcap, parsing nmap, simple for loop automation, and parsing HTML). The video ends with a quick proof of concept example of how to enumerate *most* of Facebook’s public infrastructure using a single bash command.
Check it out below:
A common practice in SOCs is to periodically resolve known hostile domains to identify changes in adversarial infrastructure. There are a variety of approaches to help you track hostile infrastructure but your mileage may vary. If your monitoring capabilities are tuned to look for specific domains, you may end up adding a significant number of unnecessary alerts to your SIEM. If your organization actively poisons specific DNS requests, you may just change your code to point to 8.8.8.8. Unfortunately, that approach still lets an eavesdropper see what domains you are actively resolving.
Recently, Google began offering a DNSSEC-validating resolution over an encrypted HTTPS connection to mitigate some privacy and security concerns. Essentially, you can submit domains over a secure channel and let Google do the resolution for you! The API is clean and very responsive. To help us and hopefully others track infrastructure in a secure manner, we created a simple Python client to interface with the DNS-over-HTTPS API. The code is publicly available at https://github.com/wglodek/dns-over-https.
[code lang=”py”]
>>> from dns_over_https import SecureDNS
>>> r = SecureDNS()
>>> r.gethostbyname(‘www.breakpoint-labs.com’)
u’37.60.235.49′
>>> r = SecureDNS(query_type=’AAAA’)
>>> r.gethostbyname(‘www.google.com’)
u’2607:f8b0:400d:c02::6a’
>>> r.resolve(‘www.mit.edu’)
[u’2001:590:100b:182::255e’, u’2001:590:100b:18b::255e’]
>>>
[/code]
The code turns security and privacy on by default by: 1) padding each request with a random string to minimize the probability of a side-channel attack being successful, and 2) automatically to not send any part of your IP address to the authoritative name servers.
There is a drop in replacement for Python’s `socket.gethostbyname` to turn your plaintext DNS queries into secure requests where you can have a higher degree of confidence that no one is messing with the response!
