A sinkhole is the redirection of network traffic from its original destination to a new one where the traffic has a harmless or limited effect. The US Department of Justice says researchers most commonly use it to send infected computers in a botnet to machines that collect data about them. It is also sometimes used in law enforcement operations.
- Also Called2other namesDNS sinkhole · sinkholing
- Related Terms3linked entriesCommand and control (C2) · Indicator of compromise (IoC) · Threat intelligence
What Is a Sinkhole?
A sinkhole is a way of redirecting network traffic. A US Department of Justice seizure affidavit describes it as a redirection of network traffic, which is usually malicious. The traffic goes to a new destination where its malicious function has a harmless or limited effect. Network traffic here means the data that computers send to each other over a network.
How Do Researchers Redirect Infected Computers?
The affidavit says the technique is most commonly used by cybersecurity researchers to redirect infected computers in a botnet to specified research machines to capture data about them.
A botnet is a group of infected computers under common control. The affidavit also explains how domain names work. A domain name is the readable address, and an IP address is the number that identifies a computer. The person or business that registers a domain name is called a registrant, and registrants control the IP address, and thus the computer, to which their domain name resolves. A registrant may therefore move a domain name to another computer. Changing where a domain name points is the kind of change that makes it possible to redirect traffic.
When Do Police Use a Sinkhole?
The affidavit says the technique is also occasionally used in conjunction with law enforcement operations to take control of infected victim computers in a botnet away from cyber criminals. A law enforcement takedown can include a sinkhole.
What Do Sinkhole Operators Gain from the Traffic?
According to the affidavit, the aims of the technique are to capture data about infected computers and, in some operations, to take control of them away from criminals. In both cases the traffic ends up on a machine chosen by the party doing the sinkholing, not by the criminals.
How Can a Company Run Its Own DNS Sinkhole?
CISA countermeasure CM0011 describes a DNS sinkhole as a way to send clients that ask for a malicious domain to a harmless destination. That blocks adversary command and control through known servers.
- Prepare the DNS serverCISA uses BIND and sets sinkhole zones for blocked domains in its zone configuration file.
- Build the domain listStart from public lists, remove duplicates, and confirm they do not include partner networks.
- Add domains you observeEach time a host contacts a domain tied to adversary activity, add that domain.
- Test before you rely on itRestart the DNS service and use dig and nslookup to confirm domains resolve or are blocked.
- Watch the sinkhole logsThe hosts that hit the sinkhole server are candidates for infection.
CISA lists risks. Malware that uses hard-coded IP addresses can avoid a sinkhole, and a new sinkhole entry can keep resolving until its time to live expires. A valid domain can also be sinkholed by mistake.
Is a Sinkhole the Same as a Honeypot?
Not as the affidavit describes it. A sinkhole is a redirection of traffic that was heading somewhere else. A honeypot is generally understood as a decoy system, which is a different idea.
Is a Sinkhole the Same as Blocking a Domain?
Not exactly. Blocking stops traffic, while a sinkhole sends the traffic to a different destination, as the affidavit describes.
Related Pages in the Knowledge Hub
Sources
- US Department of Justice: Affidavit paragraph h: a sinkhole redirects malicious network traffic to a destination where the effect is harmless or limited, and researchers use it on botnets.
- CISA: CISA countermeasure CM0011: DNS sinkholes redirect clients trying to reach a malicious domain to a benign destination, which blocks adversary command and control.
Also Called.
- NameDNS sinkhole
- Namesinkholing
Questions.
-
What is a sinkhole in cyber security?
A sinkhole redirects network traffic, which is typically malicious, from its original destination to a new one where it has a harmless or limited effect. The US Department of Justice describes it this way in a seizure affidavit.
-
How do researchers use a sinkhole against a botnet?
Researchers most commonly use a sinkhole to redirect infected computers in a botnet to specified research machines. Those machines capture data about the infected computers. A botnet is a group of infected computers under common control.
-
Can law enforcement use a sinkhole?
Yes. The affidavit says the technique is also occasionally used in law enforcement operations to take control of infected victim computers in a botnet away from cyber criminals.
-
Why can a domain name be redirected to a sinkhole?
A domain name is a readable address that points to an IP address. The registrant controls the IP address it resolves to and may move the name to another computer, which is the kind of change that makes redirection possible.
-
What are the risks of a DNS sinkhole?
CISA lists three risks. Malware with hard-coded IP addresses can avoid a sinkhole. A new entry keeps resolving until its time to live expires. A valid domain can also be sinkholed by mistake.
In Our Research
- 1 Law enforcement takedown Glossary term