Block Port 53

[TechMonkey]

I know, I know, it is DNS but I was reading an article about containing Crypto Ransomware and one suggestion was to block Port 53 at your edge firewall from all devices except your DNS servers. That way any legitimate device will go to your server, any dodgy device or dodgy software trying to DNS directly is blocked and shutdown.

 

This sounds sensible and logical but could I be causing issues if I do it? Is there any thing else that may legitimately want to contact DNS directly? Has anyone else done this all ready?

[FN-GM]

I have signed upto this, its not ready yet but will be soon

 

https://www.ncsc.gov.uk/guidance/dns-resolver-service-government-frequently-asked-questions

 

I plan to only allow these DNS services on my firewall for the reasons you said above

Edited December 13, 2016 by FN-GM

[Stuarte]

Exchange could be configured with external forwarders. Anything that is vlan'd away from your internal DNS and has its own DHCP server (such as enterprise wifi or telephony) may well look outside for dns. Shouldn't be too hard to find out though. Is it common for ransomware to require access to public dns records? Guess so...

[TechMonkey]

Exchange could be configured with external forwarders. Anything that is vlan'd away from your internal DNS and has its own DHCP server (such as enterprise wifi or telephony) may well look outside for dns. Shouldn't be too hard to find out though. Is it common for ransomware to require access to public dns records? Guess so...

 

The article (which of course I can't find now) was saying that ransomware normally has a DNS server address hardcoded in so blocking it from phoning home will stop it being able to communicate with its command and control server.

 

Would Exchange not use your internal DNS to resolve, the external forwarder would be using a different port for mail?

[Stuarte]

The article (which of course I can't find now) was saying that ransomware normally has a DNS server address hardcoded in so blocking it from phoning home will stop it being able to communicate with its command and control server.

 

Would Exchange not use your internal DNS to resolve, the external forwarder would be using a different port for mail?

 

Ah, thanks. Yes, usually Exchange would usually point to internal dns but can also be configured to look outside within the properties of the hub transport role in certain circumstances. Not the most common scenario but worth checking

[MatthewL]

I've only ever allowed my DNS servers to connect on port 53 and only to the DNS servers specified in my firewall.

[localzuk]

Seems like a sensible thing to do to be honest. Same with SMTP also. No need for all devices to be able to connect to random DNS servers or SMTP servers.

[MatthewL]

As a rule of thumb I block everything going out and only allow what needs to be, so for example on a site that isn't using a proxy only 80 and 443 are allowed for clients for web traffic and any other specific things and then only allowed to the IP's they need to.

[mikkydoos]

I have signed upto this, its not ready yet but will be soon

 

https://www.ncsc.gov.uk/guidance/dns-resolver-service-government-frequently-asked-questions

 

I plan to only allow these DNS services on my firewall for the reasons you said above

 

They dont publicise these things very well do they.

 

Cheers for that @FN-GM