Unbound Domain Name Server Updated to Run on Windows

NLnet Labs and Nominet today announces Unbound, an open source domain name server (DNS), is now available to all Windows operating systems including Windows XP and Vista. This Unbound update further supports the deployment of Domain Name System Security Extensions (DNSSEC), a technology designed to enhance the security of the Internet as a whole.

Windows Unbound is Ipv6 compatible recursive caching validating DNS server. It looks up the domain name in the global DNS system to get the address and stores it to allow ISPs, broadband suppliers, or cable companies, to quickly direct end-users to their desired websites. It also performs DNSSEC validation checks on the DNS data, verifying that the information it retrieves is both correct and authentic. Such checks help protect users of the Internet against a range of security exploits.

Unbound was already available on Unix varieties such as Linux, OS X, and FreeBSD" says Wouter Wijngaards, the project's leader at NLnet Labs; "But we are keen for as many users as possible to reap the benefits from Unbound, which is why we have made it available to Windows platforms. There are millions of Windows users and it is great that we can now offer our high performance, secure, alternative (to Berkeley Internet Name Domain (BIND)) domain name server, for more platforms."

Lesley Cowley, CEO at Nominet continues; "Domain name servers are an incredibly important but completely hidden part of the Internet. Continued development of Unbound is an important part of ensuring that the DNS infrastructure is kept up to date and protected against security threats."

Windows Unbound is available as a download from http://unbound.net/download.html, and runs in the same way as it would run on Unix systems. The code is open source and can be used in other products under the BSD license. It has been designed to be as accessible to developers as possible.

Source: http://newsblaze.com/story/2009061202595700001.bw/topstory.html

How to Monitor your outbound DNS connections.

The bottom line here is that it is relatively trivial for a single infected machine to undermine DHCP to corrupt the DNS settings of all workstations on the network, assuming that they are not configured with static IPs.

So how can one defend against this trojan as well as similar attacks?

Static IPs

The simplest way to defend against such trojans would surely be to hardwire the DNS settings for every workstation on the network. However, such a solution is impractical for networks larger than even a couple of dozen nodes at the most. Indeed, the increasing use of wireless networks in the enterprise — as well as laptops — serves only as additional deterrents due to the inconvenience of static settings in such circumstances.

Outbound DNS

A simpler way for larger corporations to defend against the vulnerability exposed by this trojan would be to monitor outbound DNS connections. This could mean logging down all DNS queries — which is also useful to track down suspicious traffic trends from phishing attacks. Of course, such a drastic measure comes with its own bag of user and possible managerial resistance due to its invasive nature.

An even cleaner method would be to configure an internal DNS server tasked with all domain name queries. All other DNS queries not originating from this machine are to be barred. If the resources are not available to set up an internal DNS server, more sophisticated firewalls can be used to filter only DNS queries to addresses that are not in an approved list.

In the meantime, you might want to run a quick check that the IP of the malicious DNS server — at 64.86.133.51 and 63.243.173.162 – are not currently being queried on your network.

Source: techrepublic