Amazon Route 53 DNS Firewall adds protection against Dictionary-based DGA attacks

Route 53 Resolver DNS Firewall Advanced

Starting today, you can enable Route 53 Resolver DNS Firewall Advanced to monitor and block queries associated with Dictionary-based Domain Generation Algorithm (DGA) attacks. This feature helps to protect against attacks that generate domain names by pseudo-randomly concatenating words from a predefined dictionary, creating human-readable strings to evade detection.

Route 53 DNS Firewall Advanced enables you to enforce protections to monitor and block your DNS traffic in real-time based on anomalies identified in the domain names being queried from your VPCs. This includes protections for DNS tunneling and DGA attacks, with the new addition of Dictionary-based DGA attacks.

What to do

• Configure one or multiple DNS Firewall Advanced rules specifying Dictionary DGA as the threat to be inspected.
• Add the rule(s) to a DNS Firewall rule group.
• Enforce the rule group on your VPCs by associating it directly or using AWS Firewall Manager, AWS Resource Access Manager (RAM), AWS CloudFormation, or Route 53 Profiles.

Route 53 Resolver DNS Firewall Advanced support for Dictionary DGA is available in all AWS Regions, including the AWS GovCloud (US) Regions.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.