VB2016 paper: Building a local passiveDNS capability for malware incident response

Posted by   Martijn Grooten on   May 4, 2017

Anyone who has ever investigated a malware or phishing attack will know the feeling: "if only I could find out what IP address this domain pointed to when the attack took place". If you're tasked with performing incident response in your organisation, collecting passive DNS data is probably a good idea.

One way to do this is by using the free PassiveDNS Splunk app. At VB2016 in Denver, Splunk researchers and authors of the app Kathy Wang and Steve Brant presented this app, explained how it was built and how it could be used. Their paper is now available to read (HTML and PDF) on our website, and the video of their presentation is available to view on our YouTube channel.

 passive-Figure1.jpg

 

If you're interested in what can be done with such data, make sure you come to VB2017 and watch OpenDNS researchers Dhia Mahjoub and David Rodriguez present their paper "Beyond lexical and PDNS: using signals on graphs to uncover online threats at scale".

VB2017 will take place in Madrid, 4-6 October 2017. Register now for an Early Bird discount!

 

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Firefox 59 to make it a lot harder to use data URIs in phishing attacks

Firefox developer Mozilla has announced that, as of version 59 of the browser, many kinds of data URIs, which provide a way to create "domainless web content", will not be rendered in the browser, thus making this trick - used in various phishing…

Standalone product test: FireEye Endpoint

Virus Bulletin ran a standalone test on FireEye's Endpoint Security solution.

VB2017 video: Consequences of bad security in health care

Jelena Milosevic, a nurse with a passion for IT security, is uniquely placed to witness poor security practices in the health care sector, and to fully understand the consequences. Today, we publish the recording of a presentation given by Jelena at…

Vulnerabilities play only a tiny role in the security risks that come with mobile phones

Both bad news (all devices were pwnd) and good news (pwning is increasingly difficult) came from the most recent mobile Pwn2Own competition. But the practical security risks that come with using mobile phones have little to do with vulnerabilities.

VB2017 paper: The (testing) world turned upside down

At VB2017 in Madrid, industry veteran and ESET Senior Research Fellow David Harley presented a paper on the state of security software testing. Today we publish David's paper in both HTML and PDF format.