flightsim icon indicating copy to clipboard operation
flightsim copied to clipboard
verified publisher icon alphasoc

Update hijack module to use OpenNIC servers

Open chrisforce1 opened this issue 5 years ago • 1 comments

An increasing amount of malware is using non-ICANN domains (e.g. .bazar as used by Team9) for C2, which are resolved via OpenNIC servers that we mark within Wisdom as alt_dns. We should register alphasoc.bazar via EmerDNS and update the hijack module so that it:

  • [ ] selects 3 random OpenNIC servers from the alt_dns list
  • [ ] hits each on UDP port 53 with a request for alphasoc.bazar

chrisforce1 avatar Jun 15 '20 06:06 chrisforce1

Setting to low priority for now as the hijack module is deprecated and we need to consider bringing it back.

chrisforce1 avatar Feb 26 '23 02:02 chrisforce1