European PDNS readiness

European PDNS readiness

Speakers: George Buhai (Government Liaison, Whalebone); Viliam Peli (Threat Intelligence Lead, Whalebone)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=AWXwPs7MLKs

Overview

This talk, "European PDNS readiness," delivered by George Buhai and Viliam Peli of Whalebone, delves into the critical need for robust, EU-centric Protective DNS (PDNS) infrastructure across Europe. George Buhai, focusing on the governmental perspective, outlines the strategic importance and implementation challenges of the EU-funded DNS4EU project, particularly its DNS4Gov component. He highlights the current state of digital security within EU member states, emphasizing the pervasive threat landscape where 90% of all cyberattacks leverage the Domain Name System (DNS), and an alarming four out of five devices in Europe are targets of malicious campaigns.

Viliam Peli then takes a deep dive into the technical backbone of DNS4EU's threat intelligence capabilities. He underscores the escalating threat of regionally focused cyberattacks, including ransomware and zero-day exploits, and articulates how the project leverages regional threat intelligence from national Computer Emergency Response Teams (CERTs), enhanced by Whalebone's proprietary systems, to provide real-time protection. The talk articulates a compelling vision for a digitally secure and independent European Union, addressing the inherent complexities of diverse national cybersecurity postures and the imperative for rapid, localized threat response in an evolving cyber landscape.

The significance of this discussion extends beyond technical implementation; it touches upon geopolitical autonomy and regulatory compliance. With existing DNS protection often relying on vendors outside the EU, the DNS4EU initiative directly addresses concerns around data sovereignty and adherence to regulations like NIS2. By establishing an EU-based, real-time DNS protection framework, the project aims to fortify the digital resilience of all European citizens and institutions, marking a pivotal step towards a more secure and independent digital future for the continent.

Background

▶ Watch: Strengthening EU digital security with DNS4EU (0:00)

The genesis of the DNS4EU project stems from a pressing need to fortify the digital security and independence of European Union member states. The speakers highlight a critical vulnerability: many EU institutions currently lack adequate protection at the DNS level. A significant portion of existing DNS protection services are provided by vendors operating outside the European Union, which presents challenges regarding data sovereignty and compliance with evolving EU regulations, particularly NIS2. This external reliance contradicts the spirit of strengthening digital autonomy within the bloc.

The problem is exacerbated by the pervasive nature of DNS-based attacks. Research presented in the talk indicates that a staggering 90% of all cyberattacks leverage the DNS, making it a primary vector for malicious activities. This widespread reliance on DNS for attacks means that a substantial number of devices – an estimated four out of five in Europe – are potential targets for malicious campaigns. Despite this acute threat, a unified, comprehensive, and EU-centric DNS security infrastructure has been largely absent.

Prior to DNS4EU, individual EU member states often operated with disparate and sometimes underdeveloped cybersecurity capabilities. George Buhai elaborates on the vast differences in the structure and autonomy of national cybersecurity centers across Europe. Some, like those in Ireland or Belgium, operate independently with dedicated budgets, while others are constrained by parliamentary processes, limiting their ability to initiate and fund critical security projects. This fragmentation and varied state of preparedness underscore the challenge of implementing a singular, effective security solution across the entire EU. The DNS4EU project, led by Whalebone, seeks to overcome these hurdles by providing a collaborative, EU-funded solution designed to offer real-time, localized DNS protection, thereby addressing both the technical deficit and the geopolitical imperative for digital independence.

Key Findings

▶ Watch: Flexible deployment models for national DNS protection (6:00)

The talk presents several critical findings that underscore the urgency and design principles behind the DNS4EU initiative:

• Pervasive Digital Presence and Vulnerability: Europe is a highly connected continent, with over 2 billion connected devices and 448 million unique users, representing a 95% penetration rate. This means 5.6% of the global population utilizes 12% of all worldwide devices. Alarmingly, 90% of all cyberattacks rely on DNS, and four out of five devices in Europe are currently targets of malicious campaigns. This highlights a significant exposure to cyber threats requiring a robust, systemic defense.
• Growing Regional Threat Landscape: Viliam Peli emphasizes the rapid evolution of the threat landscape, particularly the surge in regionally focused attacks. In the past year, there have been over 5,600 regionally focused ransomware attacks, and more than 60% of zero-day attacks have increased their regional focus. This trend, coupled with numerous regionally targeted IoT attacks, indicates that generic global threat intelligence is insufficient; localized, context-aware protection is paramount.
• National CERTs as Key Intelligence Sources: National CERTs possess the most accurate and timely knowledge of regional threats. However, they face significant challenges in efficiently propagating this intelligence to end-users and citizens. The traditional reporting mechanisms, such as emails to critical infrastructure administrators, are often too slow, rendering the intelligence ineffective against fast-moving threats that can cause harm within seconds or minutes.
• Rapid Adoption of DNS4EU/DNS4Gov: Despite the complexity of engaging diverse national governments, the DNS4EU project has achieved significant traction. As of the presentation, over 20 of the 27 EU member states are in later stages of onboarding, with more than 18 Proofs of Concept (PoCs) underway with national centers, public authorities, hospitals, schools, and critical infrastructure. The first governmental full deployment and a defense project are slated for 2025, demonstrating strong political and operational buy-in.
• Effective Threat Intelligence Sharing: The project has successfully onboarded 17 national CERTs onto its MISP (Malware Information Sharing Platform) instance, facilitating efficient threat intelligence exchange. This collaboration, involving over 70 consortium members, is crucial for building a collective defense mechanism.
• Whalebone's Industry-Leading Performance: Whalebone, the project leader, demonstrates significant capabilities in threat detection. In the month prior to the talk, it blocked over 3.8 billion malicious domain accesses. Its database contains over 27 million unique malicious domains, with more than 350,000 new domains being evaluated and added daily. Independent benchmarking consistently shows Whalebone outperforming competitors with higher blocking rates and low false positives, ensuring both security and trust.

Technical Deep Dive

▶ Watch: Try DNS4EU today: free testing for institutions (14:00)

The technical architecture and threat intelligence mechanisms behind DNS4EU, particularly the DNS4Gov component, are designed to address the unique challenges of protecting diverse governmental and public sector entities across the EU.

DNS4Gov Architecture: A Multi-Tenant, Hierarchical Approach

George Buhai detailed a multi-tenant, hierarchical structure for DNS4Gov, engineered to accommodate the vast flexibility and uniqueness of each EU member state. This architecture acknowledges that no two governments in Europe are alike, necessitating a highly customizable solution.

The core of the architecture is structured in vertical tenants, ensuring data isolation and customized policy application:

• National Center: Sits at the apex, overseeing the entire national deployment.
• Ministerial Level: Ministries (e.g., Health, Internal Affairs) operate as distinct tenants.
• Regional Level: Regional government bodies, police centers, etc.
• Local Level: Municipalities, local schools, hospitals.
• Remote Employees: Individual devices requiring protection wherever they are.

This design allows for vertical data sharing upwards (e.g., regional police sending data to the Ministry), but critically, no lateral data sharing between peer tenants (e.g., Ministry of Health data is not shared with Ministry of Internal Affairs). Each group of devices can define its own dependencies and policies, including specific block lists and allow lists.

Deployment options are flexible:

• No Deployment Option: Institutions lacking cybersecurity staff or hardware (e.g., remote schools) can simply direct their DNS traffic to national resolvers or DNS4EU's cloud resolvers for instant protection.
• Standard Deployment: Typically used for national Public Sector Centers (PSCs), hospitals, and critical infrastructure, where feeds are sent to national resolvers, often located within national cybersecurity centers.
• Full-on National Plan: A hybrid model combining cloud services and on-premise resolvers at national centers, forming a comprehensive national security framework.

A key feature is individual domain grading. For instance, a Ministry of Health might enforce very high restrictions, blocking adult or gambling content to ensure a "perfectly healthy" environment for patients and visitors. Conversely, the Ministry of Internal Affairs might require more leniency, allowing police officers to access and investigate potentially malicious websites for operational purposes. Institutions can manually adjust these grading mechanisms, audit logs to track device requests, implement content filtering, and configure blocking options based on their specific needs and policies.

Threat Intelligence: Global, Regional, and Real-time

Viliam Peli detailed Whalebone's sophisticated approach to threat intelligence, which forms the core of DNS4EU's protective capabilities. This involves a blend of global and regional intelligence, processed through an iterative, real-time pipeline.

Sources of Threat Intelligence:

Whalebone aggregates data from a diverse array of sources:

• National CERTs: Crucial for regional threat insights.
• Research Vendors & Other Vendors: Commercial and academic threat intelligence feeds.
• In-house Malware Research Analysis: Proprietary analysis of new malware samples.
• Passive DNS Traffic: Monitoring global DNS queries for anomalies and malicious patterns.
• Collaborations: Partnerships with banks, telcos (leveraging their Security Operations Centers), and universities (e.g., Czech University Chevute for machine learning models).
• Partnership Licenses: Access to specialized threat intelligence feeds.
• Neural Network Models, DJ Tunneling, DNS Tunneling: Advanced detection techniques.

Threat Intelligence Processing Pipeline:

1. Collection: IoCs (Indicators of Compromise) are gathered from all sources.
2. Enhancement: Collected data is enriched with statistics, historical observations, tags, and commentary. This includes checking if an IoC has been seen before.
3. Evaluation/Scoring: Multiple automated bots classify and score IoCs to determine their maliciousness. This critical step prevents the blocking of benign domains (e.g., Facebook, Google) that might be erroneously reported.
4. Propagation: Confirmed malicious domains are immediately propagated to DNS4EU resolvers, ensuring real-time protection for all users.
5. Iteration: The entire process is continuous, ensuring the most recent data and scoring for all domains.

Regional Threat Detection:

Recognizing the unique nature and rapid growth of regional threats, Whalebone developed a specialized approach:

1. Research: In-depth study of a specific region or country to identify local brands, services (e.g., postal services, banks), and common attack vectors.
2. Threat Detection Models: Training AI/ML models on region-specific data and known local threats.
3. AI-Powered Analysis and Blocking: The AI pipeline evaluates newly formed threats specific to the region.
4. Manual Analysis Review: Human analysts review the pipeline's output to ensure correct tuning and accuracy, evaluating detection rates.
5. Iteration: Continuous re-research and refinement of regional models.

A powerful tool in this process is Certstream, which monitors newly issued certificates for domains. By analyzing these certificates, DNS4EU can proactively identify and block malicious domains even before they are actively used in attacks or discovered by users.

Case Studies:

Viliam Peli cited specific examples, such as the APT29 (Cozy Bear) group targeting German political parties (CDU) in 2023. This campaign involved compromising WordPress websites and creating fake invitations to spread malware. Regional threat intelligence, combined with CERT cooperation, enabled detection and prevention of similar future campaigns. Another example highlighted fake streaming platforms that, when a "play button" is clicked, initiate the download of a 13,000-line JavaScript from a Russian domain, designed to monitor HTML and steal personal financial data, adaptable to various languages and alphabets. These cases underscore the necessity of sophisticated, real-time, and regionally aware threat intelligence.

Demo / Proof of Concept

▶ Watch: Whalebone's real-time threat intelligence pipeline (20:00)

While the talk did not feature a live, interactive demonstration, the speakers highlighted the practical availability and testing opportunities for DNS4EU and DNS4Gov.

For individual users, George Buhai provided a QR code linking to documentation for installing and using DNS4EU on personal devices. This public resolver service is capped at approximately 1,200 queries per second, which is more than sufficient for personal use, allowing citizens to immediately benefit from the project's protective capabilities.

For public institutions and governmental bodies, the DNS4Gov service is being offered free of charge for an initial testing period of 3 to 6 months, with options for extensive testing thereafter. This offer includes support for both on-premise installations within national data centers and utilization of DNS4EU's cloud resolvers. This approach serves as a robust proof-of-concept phase, allowing institutions to rigorously evaluate the system's effectiveness and integration without upfront financial commitment, facilitating broader adoption across EU member states. This strategic offering underscores the project's commitment to widespread deployment and tailored national plans.

Defensive Implications

▶ Watch: Case study: Regional intelligence blocks APT29 attacks (28:00)

The insights shared in this talk present clear and actionable implications for defenders across the European Union, from national cybersecurity centers to individual organizations and citizens.

For EU Member States and Public Institutions:

• Prioritize EU-based DNS Security: Given the NIS2 directive and concerns about data sovereignty, adopting an EU-based DNS protection service like DNS4EU/DNS4Gov is not merely a technical upgrade but a strategic imperative. It ensures that critical DNS traffic and associated intelligence remain within the EU, bolstering digital independence.
• Leverage Hierarchical, Multi-tenant Architectures: The DNS4Gov model offers a blueprint for organizing national DNS security. Institutions should embrace such flexible, multi-tenant frameworks to tailor security policies, content filtering, and access controls to the specific needs and risk profiles of different departments (ee.g., Ministry of Health vs. Ministry of Internal Affairs). This allows for granular control and prevents one-size-fits-all policies that may hinder operations or be insufficient for critical areas.
• Actively Participate in Threat Intelligence Sharing: The success of regional threat intelligence hinges on collaboration. National CERTs and other cybersecurity entities should actively contribute to and consume intelligence from platforms like the DNS4EU MISP instance. Rapid sharing of IoCs, especially region-specific ones, can significantly reduce the window of vulnerability.
• Embrace Proactive Detection Mechanisms: Defenders should look beyond reactive blocking. Implementing solutions that leverage techniques like Certstream to identify and block malicious domains based on newly issued certificates can provide a crucial preemptive defense layer, stopping attacks before they even reach users.
• Utilize Free Testing Opportunities: Public institutions should take advantage of the 3-6 month free testing period for DNS4Gov. This allows for thorough evaluation of the service's efficacy, integration capabilities, and alignment with national cybersecurity strategies, whether through on-premise or cloud deployments.
• Address Transposition Gaps for NIS2: The disparity between NIS2 transposition and DNS4Gov readiness highlights areas where countries need to accelerate their cybersecurity infrastructure development to meet regulatory requirements and effectively combat threats.

For All Organizations and Individual Users:

• Recognize DNS as a Primary Attack Vector: With 90% of attacks relying on DNS, organizations must treat DNS security as a foundational element of their cybersecurity strategy, not an afterthought. Investing in advanced DNS protection is as critical as endpoint or network security.
• Prioritize Regional and Real-time Threat Intelligence: The rapid growth of regionally focused ransomware and zero-day attacks necessitates DNS security solutions that can integrate and act upon local threat intelligence in minutes, not days or weeks. Reliance on global, generalized feeds alone is insufficient.
• Be Wary of Evolving Attack Techniques: The case studies, such as fake streaming sites delivering sophisticated JavaScript malware or APT groups leveraging compromised legitimate websites, underscore the need for user education and technical controls that can detect and block complex, multi-stage attacks.
• Consider Personal DNS Protection: Individual users are also targets. Utilizing services like the public DNS4EU resolvers can provide a vital layer of protection against common DNS-based threats on personal devices.

Overall, the talk serves as a call to action for a collective, intelligence-driven, and geographically aware approach to DNS security, emphasizing collaboration, advanced technical capabilities, and strategic autonomy within the European digital landscape.

Key Takeaways

• EU-Centric DNS Protection is Critical: DNS4EU is an EU-funded initiative providing an EU-based, real-time DNS protection solution to enhance digital security and independence, directly addressing data sovereignty and NIS2 compliance concerns.
• Regional Threat Intelligence is Paramount: Rapidly evolving and increasingly localized cyber threats (e.g., >5,600 regional ransomware attacks) necessitate regional threat intelligence, gathered from national CERTs and enhanced by Whalebone, for effective and timely defense propagation.
• Flexible, Hierarchical Architecture for Governments: The DNS4Gov architecture offers a highly customizable, multi-tenant, and hierarchical framework, allowing EU member states to define and apply specific DNS security policies, content filtering, and access controls for various governmental levels and institutions.
• DNS is a Primary Attack Vector: An alarming 90% of all cyberattacks rely on DNS, with four out of five devices in Europe being targets, underscoring the critical need for robust and pervasive DNS security.
• Proactive Threat Detection and Real-time Propagation: Advanced techniques like Certstream enable proactive blocking of malicious domains based on newly issued certificates, often before they are actively used in attacks, while a continuous intelligence pipeline ensures real-time propagation of threat data to resolvers.
• Collaboration and Intelligence Sharing are Essential: The successful onboarding of 17 national CERTs onto the DNS4EU MISP instance demonstrates the vital role of collaborative intelligence sharing in building a collective and robust defense against sophisticated and rapidly propagating threats.

About the Speaker(s)

George Buhai serves as the Government Liaison for DNS4EU at Whalebone. In this role, he is primarily responsible for assessing the maturity and acquisition readiness of EU member states for protective DNS projects. He actively engages with national CERTs and national cybersecurity centers across Europe, spearheading efforts to design and implement comprehensive national DNS protection plans. Within the DNS4EU consortium, George is the dedicated lead for the governments and public institutions pillar.

Viliam Peli is the Threat Intelligence Lead at Whalebone and is also responsible for threat intelligence exchange within the DNS4EU project. His expertise lies in understanding the evolving threat landscape and developing advanced strategies for regional threat detection. Viliam oversees the technical mechanisms for gathering, processing, and propagating threat intelligence, including leveraging national CERT data and Whalebone's proprietary analysis to ensure real-time protection for DNS4EU users.