System and method for detecting and mitigating DNS spoofing trojans
View Patent ↗Embodiments of the present invention relate to a method and system for detecting and/or mitigating domain name system (DNS) spoofing Trojan horse (or Trojan) code. Trojan code (sometimes called malware or malicious software) is a common computer security problem. Some Trojans modify the DNS resolution mechanism employed by the infected computer, such that the computer traffic, when browsing the Internet, is routed to a location not intended by the rightful owner of the computer. The present invention can detect this phenomenon from a remote device or location and may take action to mitigate its effects.
1. A method for detecting spoofing, the method comprising:
receiving notification of an IP request originated by a browser application, said IP request being associated with a requested IP address and a desired hostname;
detecting whether the requested IP address matches the desired hostname; and
if said requested IP address does not match said hostname, then:
obtaining a correct IP address associated with said desired hostname; and
directing said browser application to said correct IP address.
2. The method of claim 1 , wherein said step of detecting whether the requested IP address matches the desired hostname comprises comparing at least one property of the requested IP address with a comparable property of the desired hostname.
3. The method of claim 1 , wherein if said IP address does not match said hostname, further comprising preventing connection to said IP address.
4. The method of claim 1 , wherein said step of detecting comprises:
obtaining a true hostname associated with said requested IP address; and
comparing said true hostname with said desired hostname.
5. The method of claim 4 , wherein obtaining a true hostname associated with said requested IP address comprises using a reverse DNS lookup database.
6. The method of claim 4 , wherein obtaining a true hostname associated with said requested IP address comprises using a WHOIS database to look up identity of said requested IP address.
7. The method of claim 1 , wherein said IP request is made by said browser application of a subscriber using a computing device, and wherein if said IP address does not match said hostname, further comprising sending a notification to said subscriber computing device.
8. The method of claim 1 , wherein said IP request is made by said browser application of a subscriber using a computing device, and wherein if said IP address does not match said hostname, further comprising directing said browser application of said subscriber to an Internet website informing said subscriber that said IP address does not match said hostname.
9. The method of claim 1 , wherein if said IP address does not match said hostname, further comprising sending a notification to a third party.
10. The method of claim 1 , wherein said notification of said IP request is a reply from a domain name server directed to said browser application of a subscriber, said reply including said requested IP address.
11. The method of claim 1 , wherein said notification is an IP request received by an internet service provider (ISP) from a subscriber of said ISP.
12. A method comprising:
receiving a notification of a request sent by a browser application of a client computer to a network address, said request being associated with a requested network address and a desired hostname;
detecting whether the requested network address matches the desired hostname; and
if said requested network address does not match said hostname, then:
obtaining a correct network address associated with said desired hostname; and
directing said browser application to said correct network address.
13. The method of claim 12 , wherein the network address is an IPv6 network address.
14. A computer system comprising:
a server computer including an analyzer processor to receive notification of an IP request originated by a browser application operating on a client computer, said IP request being associated with a requested IP address and a desired hostname, and to detect whether the requested IP address matches the desired hostname;
wherein if said requested IP address does not match said hostname, then said server is to:
obtain a correct IP address associated with said desired hostname; and
direct said browser application to said correct IP address.
15. The computer system of claim 14 , wherein said analyzer processor is to compare at least one property of the requested IP address with a comparable property of the desired hostname.
16. The computer system of claim 14 , wherein said notification is received from said browser application operating on said client computer, and wherein said server computer is to prevent connection of said browser application to said IP address if said IP address does not match said hostname.
17. The computer system of claim 14 , wherein said analyzer processor is to obtain a true hostname associated with said requested IP address, and to compare said true hostname with said desired hostname.
18. The computer system of claim 17 , wherein said analyzer processor is to obtain said true hostname associated with said requested IP address using a reverse DNS lookup database.
19. The computer system of claim 17 , wherein said analyzer processor is to obtain said true hostname associated with said requested IP address using a WHOIS database able to look up identity of said requested IP address.
20. The computer system of claim 14 , wherein said IP request is made by a subscriber using said browser application on the client computer, and wherein if said IP address does not match said hostname, said server computer is to send a notification to said subscriber.
21. The computer system of claim 14 , wherein said IP request is made by a subscriber using said browser application on the client computer, and wherein if said IP address does not match said hostname, said server computer is to direct said browser application of said subscriber to an Internet website informing said subscriber that said IP address does not match said hostname.
22. The computer system of claim 14 , wherein if said IP address does not match said hostname, said server computer is to send a notification to a third party.
23. The computer system of claim 14 , wherein said notification of said IP request is a reply from a domain name server directed to a subscriber, said reply including said requested IP address.
24. The computer system of claim 14 , wherein said notification is an IP request received by an internet service provider (ISP) from a subscriber of said ISP.
25. The computer system of claim 14 , further comprising a client computing platform to send to said server computer said notification of IP request.
26. A method comprising:
receiving at a computing device a notification of a request originated by a browser application, said request including a physical address of a computing element being associated with a requested physical address and logical address; and
determining whether said requested physical address matches the logical address;
wherein if said requested physical address does not match said logical address, then said computing device is to:
obtain a correct physical address associated with said logical address; and
direct said browser application to said correct physical address.
27. The method of claim 26 , wherein the physical address is selected from a group consisting of: an IP address of an Internet site, a network address, and an IPv6 address, and at least a portion of a header of an electronic mail header.
28. The method of claim 26 , wherein the logical address is selected from a group consisting of: a hostname, and a Uniform Resource Locator (URL).
29. The method of claim 26 , wherein the computing device is selected from a group consisting of: a Personal Computer (PC), a DNS server, an HTTP server, and a firewall device.
30. The method of claim 26 , wherein the step of determining whether said requested physical address matches the logical address comprises using a WHOIS database.
31. The method of claim 26 , wherein the determining whether said requested physical address matches the logical address comprises performing DNS queries to DNS servers to using the requested physical address and comparing a logical address returned in response to such DNS queries to said logical address.
32. The method of claim 2 , comprising:
determining whether the requested IP address appears in a pre-defined white list of IP addresses.
33. The method of claim 2 , comprising:
determining whether the requested IP address does not appear in a pre-defined black list of IP addresses.
34. The method of claim 2 , comprising:
determining whether the requested IP address does not correspond to a pre-defined domain name.
35. The method of claim 2 , wherein detecting comprises detecting using at least one of a cache proxy server, a content inspection server, an HTTP-aware device, a device able to sniff network data, a transparent proxy server, and a plurality of distributed computing platforms.
36. A method for detecting spoofing, the method comprising:
receiving notification of an IP request originated by a browser application, said IP request being associated with a requested IP address and a desired hostname;
detecting whether the requested IP address matches the desired hostname; and
if said IP address does not match said hostname, notifying an entity in control of a network in which the IP request was transferred.
37. A method for detecting spoofing, the method comprising:
receiving notification of an IP request originated by a browser application, said IP request being associated with a requested IP address and a desired hostname wherein said IP request is made by a subscriber;
detecting whether the requested IP address matches the desired hostname, wherein if said IP address does not match said hostname, further comprising:
obtaining a correct IP address associated with said desired hostname.
38. The method of claim 1 , comprising:
based on a physical address class, detecting whether the requested IP address matches the desired hostname.
39. The method of claim 1 , comprising:
based on a physical address class included in a pre-defined list of IP addresses, detecting whether the requested IP address matches the desired hostname.
40. The method of claim 1 , further comprising:
performing a corrective operation on said IP request.
41. The method of claim 40 , wherein the corrective operation is selected from a group consisting of: notifying a client from which the IP request originated, cleaning a Trojan in a client from which the IP request originated, obtaining a correct IP address from a trusted source, sending a security notification to a client from which the IP requested originated, sending a notification to an anti-virus manufacturer, performing a silent rerouting, sending a notification to a phish-fighting entity, and communicating with a help desk.
42. The method of claim 1 , further comprising:
performing a corrective operation on said IP request at a server of an ISP.
43. The method of claim 1 , further comprising:
if the desired hostname corresponds to a sponsor entity, detecting whether the requested IP address matches the desired hostname.
44. The method of claim 1 , further comprising:
if the desired hostname corresponds to a sponsor entity, performing a corrective step on said IP request.
45. The method of claim 1 , further comprising:
if the desired hostname corresponds to a sponsor entity, performing a corrective step on said IP request at a server of an ISP.
46. The method of claim 1 , further comprising:
if the desired hostname corresponds to a sponsor entity, notifying said sponsor entity.
47. The method of claim 2 , comprising:
determining by an ISP server whether the requested IP address does not correspond to a pre-defined domain name.
48. The method of claim 2 , comprising:
determining by a firewall server whether the requested IP address does not correspond to a pre-defined domain name.
49. The method of claim 2 , comprising:
determining by an Internet gateway whether the requested IP address does not correspond to a pre-defined domain name.
50. The method of claim 2 , comprising:
determining by a personal computer whether the requested IP address does not correspond to a pre-defined domain name.