Whalebone

DNS Security

About Whalebone

Whalebone is a Czech cybersecurity and digital life protection company. Since 2016, Whalebone has provided real-time DNS security to more than 400 telcos, ISPs, and institutions worldwide, protecting internet users from cyberthreats through a combination of threat intelligence and machine learning.

BOOK A DEMO

Whalebone Immunity

Stolen data, lost income, and reputation damage average $4.45 million per cyber attack. The risk is too high to just rely on firewalls, antivirus, and standard solutions without securing a critical part of the internet infrastructure — your DNS resolution. Whalebone DNS security can shine a light on your customer’s DNS, providing them with invaluable insights into threats within their infrastructure, and real-time protection against DNS attacks. Whalebone Immunity stops malware, phishing, DNS- based threats, homographs attacks, and more before they reach your network. That’s why there is no need to install or maintain any software on any device. Additionally, you can widen the perimeter to your remote employees as well. No other security layer offers this level of protection while saving an IT team’s time and budget instead of depleting it.

READ OVERVIEW

The Importance of DNS Security

The Domain Name System (DNS) is everywhere, and it receives significantly high traffic volume, making it the perfect place for attackers to hide their malicious activity. Bad actors abuse DNS through a multitude of techniques to deliver malware and exfiltrate data. Unfortunately, DNS is a blind spot for many businesses. Security teams often lack basic visibility into how threats use DNS that would enable them to respond effectively.

DNS Tunneling

DNS tunneling uses DNS traffic to smuggle information or code in or out of the network. It is used to steal data or control malware. Based on one single query it is impossible to identify a DNS tunnel. Some firewalls may even look at each single query to detect known malicious codes, but they do not have the capacity to store the information and analyse patterns, which is exactly what Whalebone Immunity does, blocking the traffic deemed suspicious. An example of DNS tunneling is the SolarWinds attack which used DNS tunneling to steal information from almost 18,000 networks infected by their malware. Even though protective DNS would not stop the malware from getting into the network, it would block its communication with the author and immediately notify the admins, thus preventing any damage.

FAQs

Why do I need Whalebone Immunity if I already have antivirus, next-gen firewall, Intrusion Detection and Prevention Systems (IDS/IPS), and other measures?

With the standard stack you are not protected from DNS tunneling/spoofing/poisoning (DNS-based attacks), attacks using domain generation algorithms (DGAs), homographic phishing (spear phishing), attacks using IoT devices, and abusing leaked credentials.

If you get DNS protection, you will have those covered, gaining maximum confidence that your network is as protected as possible.

Will Whalebone Immunity alert me of an attack? And what information will it provide?

During the set-up, you can choose the threshold after which Whalebone Immunity alerts you of suspicious behavior and another one behind which Whalebone Immunity will straight up block the threat. The alerts will provide not only information about the threat, but even the IP address of the targeted device – or even the device name if you set it up during an easy step within the deployment.

What makes Whalebone Immunity’s threat intelligence unique?

Apart from numerous threat intelligence feeds, Whalebone Immunity uses unique regional threat intelligence data from telecommunication providers and public organisations within the DNS4EU projects.

The data is used not only to distinguish the malicious domains missed by global databases, but also to teach a neural network, enabling it to identify malicious domains which are not a part of any database with 99% success-rate.

Thanks to the unique data, you get an extra layer of protection which your current stack might miss – more than 50% of our customers identify such threats just during the trial period.

How does DNS spoofing/cache poisoning bypass the standard security measures?

DNS spoofing (or DNS cache poisoning) is used to manipulate the DNS to redirect your traffic to a fake website – usually mimicking the one you originally wanted to access. There they can prompt you to insert your password or to download malware.

Firewalls just look at the DNS query, check it and send it on as it is. When Whalebone DNS Resolver receives the packet, it creates new traffic towards the authoritative server and after compiling the information it creates a new packet which it sends back to the device.

Given that only DNS traffic allowed in your network will be to the Whalebone DNS Resolver, the attackers can’t hijack the DNS traffic to point your request to a fake domain.