I rescued a firewall device,. I recovered DNSBL activity log from an old Linux firewall box which died after over 1,000 days of faithful service at PeopleSpace.
I was curious to know how many malware and ransomware it caught (and saved my skin) before it died. It was sad to see the old Linux box go, but frankly, I was surprised it lasted as long as it had. I did not revive the old Linux box. I purchased a proper Protectli firewall micro appliance and slammed in pfSense. I am happy with this move.
Intel® Quad Core Celeron J1900, 64 bit, 2.0GHz, 2MB L2 Cache
4x Intel® Gigabit Ethernet NIC ports
4GB DDR3L RAM, 8GB mSATA SSD
1x USB 2.0, 1x USB 3.0, 1x RJ-45 COM, 1x VGA
DNS is the most underappreciated human-electronics interface in the internet age.
The DNS log of a compromised machine is a treasure trove of data when it comes to identifying which other devices may also be infected. The log contains Dynamic Name Server (DNS) queries and the data on the clients that requested them. The log can show the connections a suspected device has made in the past and may attempt to make in the future. It may yield a maverick method of catching and containing the spread of malware.
This research started with repurposing an old Pentium II with m0n0wall. m0n0wall is a project aimed at creating a complete, embedded firewall software package that, when used together with an embedded PC, provides all the important features of commercial firewall boxes (including ease of use) at a fraction of the price (free software). m0n0wall is based on a bare-bones version of FreeBSD, along with a web server, PHP, and a few other utilities. The entire system configuration is stored in one single XML text file to keep things transparent.
Since then I had upgraded from m0n0wall to pfSense. pfSense is commonly deployed as a perimeter firewall, router, wireless access point, DHCP server, DNS server, and as a VPN endpoint. pfSense supports the installation of third-party packages like Snort or Squid through its Package Manager. The pfSense project started in 2004 as a fork of the m0n0wall project by Chris Buechler and Scott Ullrich and the first release was in 2006. The name was derived from the fact that the software uses the packet-filtering tool, PF.
How the log is created
I wanted to take advantage of DNSBL feeds to filter out adware, malware and ransomware domains. I also wanted to use openDNS (208.67.222.222 208.26.220.220) I felt like I am getting double protection. I ran namebench which provides personalized DNS server recommendations based on browsing history to make sure I was reasonably close to openDNS servers.
The problem with running DNSBL feed and openDNS together is
DNSBL feed likes DNS resolver only
openDNS likes DNS forwarder
You can not run both DNS resolver and DNS forwarder
The following steps will show how to run DNSBL feed and openDNS by running DNS forwarder off and DNS resolver on.
Services > DNS forwarder
Services > DNS resolver
Enable DNS resolver on
DNSSEC is off
DNS Query Forwarding on
The custom options should be auto populated when you set up DNSBL
Services > Dynamic DNS > Dynamic DNS Clients > Edit
Get an account/password at www.opendns.com
Firewall > pfBlockerNG > General
System > General Setup
The client's LAN interface uses pfSense as the DNS resolver. When the client tries to visit a website (say www.yahoo.com) a DNS request for yahoo.com will be intercepted by the pfSense firewall. Its package, pfBlockerNG will compare against lists of bad domains. If a bad domain is called up, the client will get 1 x 1 pixel gif from a webserver on 10.10.10.1 If all is well, the client will be connected to yahoo.com. The blocked site will look like this. Just black.
Enable unbound DNS resolver. Services > DNS resolver
If it does not work, turn off IPv6.
Stop malware, adware, malvestisments and ransomware
pfBlockerNG is a pfSense package maintained by @BBcan177 pfBlockerNG adds all kinds of security such as blocking known bad IP addresses with blocklists. I use pfBlockerNG everyday.
Firewall > pfBlockerNG > DNSBL
If you want to white list a wild card, do it like this: .google.com Once whitelisted, you must UPDATE to reassemble the feed list. This step is where I got tripped up for an hour. "I configured everything, but why isn't it running?"
Firewall > pfBlockNG > DNSBL > DNSBL feed
* * * DNSBL Feeds * * * :
BBcan177_Domains_DNSBL:
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw/be5fddb116667699c246df97b79e1032ab71bb1c/MS-2
BBcan177_Threats_DNSBL:
https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw/b344ebc9475acdea1fae38a12c4ea9332838a184/MS-1
YoYo:
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext
SomeoneWhoCares:
http://someonewhocares.org/hosts/hosts
Adaway:
https://adaway.org/hosts.txt
adblockplus:
https://gist.githubusercontent.com/BBcan177/b96dd281c5acd5327825a22c63f9f9c9/raw/94c1585a189347e35c0070a9e4de76fde2adb271/liste_fr.txt
(Add googleleads.g.doubleclick.net under Custom Block List)
Microsoft_Domains:
http://jasonhill.co.uk/pfsense/microsoft_domains.txt
Malware Immortal Domains:
http://mirror2.malwaredomains.com/files/immortal_domains.txt
Malvertising:
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
hpHosts_ads:
http://jasonhill.co.uk/pfsense/ad_servers_dnsbl.txt
Cameleon:
http://sysctl.org/cameleon/hosts
DNSBL_DGA_Domains: (WARNING 110mb file 825507 domains)
http://osint.bambenekconsulting.com/feeds/dga-feed.gz
non_sinkholed_CandCs:
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt
Ransomware Domain Blocklist (RW_DOMBL):
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
Test. Try to reach a black listed domain's ransomware website.
It goes to 10.10.10.1 which is an internal webserver showing 1x1 black gif.
Shinhan Bank installed Ahnlab Safe Transaction on my laptop, and it caught the malware site too.
x
