Preview Mode Links will not work in preview mode

Jun 13, 2016

Picture yourself in the middle of a security incident... A malware infection, or you have hosts on your network are part of a botnet.  You figured out where how the malware is communicating with the command and control servers, but if you just kill the connection, the malware stop functioning.  What do you do?

In some cases, you might be able to employ a DNS #sinkhole to route traffic harmlessly to  or through a honey network that can be used to further analyze things like #infection vectors, #protocols, commands, and #network movement. You can also use #DNS sinkholing to disable the malware if certain conditions are met.

Like most tools, sinkholing can be used for good, but there are legal issues if it's used incorrectly.  We discuss some of the legalities. It won't disable all malware or exploit kits, but for some infections, this is another tool in your toolbox you can employ.

In a continuation from last week's show with Earl Carter about the #Angler #Exploit Kit, we discuss how Angler is able to bypass #EMET and #ASLR protections...

Direct Link:




Links we used to discuss sinkholing:

Basic sinkhole app using BIND:

*UPDATED literally hours after I posted this show*  Version 2.0 of the DNS sinkhole ISO:


Blackhole DNS servers --   or

Malware blackhole DNS campaign (2013) -  -massive dns sinkholing list


Comments, Questions, Feedback:

Support Brakeing Down Security Podcast on Patreon:

#Twitter: @brakesec @boettcherpwned @bryanbrake



Player.FM :

#Stitcher Network:

#TuneIn Radio App: