4 ms·
I think it is stealthy since the data is not sent directly from the victim PC to the server, but rather the DNS server relays the file as a normal part of DNS r
by kbaker 11y ago
I think it is stealthy since the data is not sent directly from the victim PC to the server, but rather the DNS server relays the file as a normal part of DNS recursion.
Since it looks like a normal DNS request, it is much harder to filter than sending out packets on monitored and easily proxied ports like 80 and 443.
I certainly wouldn't want to try and whitelist every DNS entry on the whole Internet...
- mercora 11y agoI don't think it is possible to use recursion for this. At least not reliably, as its quite likely you will hit a cached record. Which means the file would not have been transferred completely to your authoritative server... (using some kind of counter could help though)
- nbevans 11y agoSimple enough to ensure each transfer uses both a unique transfer id and then a simple packet sequence number counter. This would ensure every request is unique.