I had fun a few years ago bypassing captive portals using iodine to tunnel traffic over DNS. However, now that I'm professionally on the defensive side, this wa

I had fun a few years ago bypassing captive portals using iodine to tunnel traffic over DNS. However, now that I'm professionally on the defensive side, this was one of the methods of data exfiltration that was really hard to block on AWS until recently. While GuardDuty may trigger on reckless usages of such approach, more cautious ones are slipping under the radar and preventing them implied replacing Route53 by a custom solution (pretty unpractical). Thankfully, AWS recently allowed access to Route53 logs (https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-with-route-53-resolver-query-logs/ https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-wi...) that can be monitored to spot abnormal behavior.