As usual, we're trying to tighten security even further in our organisation. The current focus for me is the possibility of a compromised XP client from using DNS lookups as a command/control channel (Google "dns malware command control channel").
Of course, this presupposes that a client could be compromised in the first place; something that we believe very unlikely. That said...
We're currently a Windows Server 2003 AD shop, with all DNS zones stored in AD. The DNS servers are allowed to forward to our ISP's DNS serverz - something that is required by a number of servers, i.e.: we need to resolve external addresses for B2B stuff.
The XP clients and Windows servers are on the same domain, and therefore share the same DNS servers. The clients can therefore perform external address lookups.
If a client were to be compromised, it could before a lookup of whatsmynextmove.hacker.com, and the SOA for that domain could return a crafted reply which holds the control instruction.
So, the question is, can anyone think of a way of preventing the XP clients from performing DNS lookups for domains other than the local DNS domain (the one for the AD forest).
My thoughts so far:
1) Get some kind of proxy man-in-the-middle DNS product that the XP clients use. The proxy filter lookups for domains other than the internal domain.
2) Identify all the external domains that we need to resolve and configure conditional forwarders for each of them, e.g.: microsoft.com, verisign.com, redhat.com, Etc, Etc. I'm not sure how many conditional forwarders can be configured.
Any thoughts.... anyone?