4 ms·

Corollary is, spyware can use DNS to exfiltrate data [0]. Or, send out client-side metrics with cleverly drafted DNS requests [1], or use it as a 3p-cookie repl

Corollary is, spyware can use DNS to exfiltrate data [0]. Or, send out client-side metrics with cleverly drafted DNS requests [1], or use it as a 3p-cookie replacement [2]. [0] https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/ https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-ca... [1] https://github.com/Jigsaw-Code/choir https://github.com/Jigsaw-Code/choir (disclosure: I co-develop hard-forks of two other related Jigsaw-Code projects) [2] http://dnscookie.com/ http://dnscookie.com/

jacobkiers 5y ago
Interesting, I'll read up on that.
k4ch0w 5y ago
Packet size is a really good detection for this. DNS packets should only be so big ;)
- deleted 5y ago
  [deleted]
- richthegeek 5y ago
  So I split my packets up into smaller chunks. Now you need to rate limit DNS. But you still need to allow regular DNS traffic somehow, or you break the internet.
  - k4ch0w 5y ago
    Well, allowlist to a known DNS server and block anything on DNS that isn't allowlisted.
    - ignoramous 5y ago
      The exfiltrated data isn't for DNS resolvers but is leaked to Nameservers through them. A similar technique forms the basis of how services like dnsleaktest.com and which.nameserve.rs identify DNS resolvers in-use by a particular client.
- LinuxBender 5y ago
  And packet rate. Some corporate firewalls may detect this as abusive and block it leading to questions from the security operations team and the person testing this out.
deleted 5y ago
[deleted]
3pt14159 5y ago
Fun story about this. I know one of the former guys at Xobni back in the day when it was still a thing. They had made an enterprise version that was sold to companies like Apple, Intel, etc. But even though the enterprise software no longer made external API calls, the company still wanted usage metrics so they could monitor feature usage. Knowing how locked down the networks were at companies like this, they exfiltrated the usage data via infrequent DNS requests to their DNS server. Everything was going fine until one day a dozen or so users at Intel stopped reporting. Hours later all of Intel stopped reported. Within the next day other companies started coming offline. Apple first, then some other large tech company and then a whole slew of them. Turns out when you spy on your users word gets around.
Spivak 5y ago
You can even set up a VPN over DNS if you really wanted. https://github.com/yarrick/iodine https://github.com/yarrick/iodine
codethief 5y ago
I'm not sure why this should be a corollary now. DNS exfiltration has always been possible, just like the article you linked to says. (I also like to point people to https://twitter.com/rsobers/status/1293539543115862016 https://twitter.com/rsobers/status/1293539543115862016 in this context because it puts the idea so succinctly.)

jacobkiers 5y ago

Interesting, I'll read up on that.

k4ch0w 5y ago

Packet size is a really good detection for this. DNS packets should only be so big ;)

deleted 5y ago
[deleted]
richthegeek 5y ago
So I split my packets up into smaller chunks. Now you need to rate limit DNS. But you still need to allow regular DNS traffic somehow, or you break the internet.
- k4ch0w 5y ago
  Well, allowlist to a known DNS server and block anything on DNS that isn't allowlisted.
  - ignoramous 5y ago
    The exfiltrated data isn't for DNS resolvers but is leaked to Nameservers through them. A similar technique forms the basis of how services like dnsleaktest.com and which.nameserve.rs identify DNS resolvers in-use by a particular client.
LinuxBender 5y ago
And packet rate. Some corporate firewalls may detect this as abusive and block it leading to questions from the security operations team and the person testing this out.

deleted 5y ago

[deleted]

3pt14159 5y ago

Fun story about this. I know one of the former guys at Xobni back in the day when it was still a thing. They had made an enterprise version that was sold to companies like Apple, Intel, etc. But even though the enterprise software no longer made external API calls, the company still wanted usage metrics so they could monitor feature usage. Knowing how locked down the networks were at companies like this, they exfiltrated the usage data via infrequent DNS requests to their DNS server. Everything was going fine until one day a dozen or so users at Intel stopped reporting. Hours later all of Intel stopped reported. Within the next day other companies started coming offline. Apple first, then some other large tech company and then a whole slew of them. Turns out when you spy on your users word gets around.

Spivak 5y ago

You can even set up a VPN over DNS if you really wanted. https://github.com/yarrick/iodine https://github.com/yarrick/iodine

codethief 5y ago

I'm not sure why this should be a corollary now. DNS exfiltration has always been possible, just like the article you linked to says. (I also like to point people to https://twitter.com/rsobers/status/1293539543115862016 https://twitter.com/rsobers/status/1293539543115862016 in this context because it puts the idea so succinctly.)