4 ms·

> Filtering TXT doesn't help. Think about it. To exfiltrate data means to send data out, so you can just encode it in the query names and forget about RR types

> Filtering TXT doesn't help. Think about it. To exfiltrate data means to send data out, so you can just encode it in the query names and forget about RR types and RDATA. Well it definitely helps in that it would completely break this tool - as far as I know, TXT exfil is the most efficient since it allows the most data transferred per query, whereas all other forms are 1/2 as efficient or worse. But I agree there are ways around it - could you tell me more about the position that the attacker is in and how that attack works? Conceptually I can think of ways for an attacker to continue to exfil, but I'm wondering if you have something specific in mind. I'm assuming you just put the data into the subdomain, or something like that, which is much slower but still viable for C2 traffic.

cryptonector 3y ago
Yes, it's putting the data into the name you're querying (the "qname" in DNS parlance). Say you have a message M of some length to exfiltrate, so first encode it as base64 or whatever, then break up the encoded message into chunks of 63 bytes (ASCII characters, since you encoded in base64), then send DNS lookups for ${n}.${chunk}.${some_label_identifying_exfiltration_instance}.${attacker_domain}. It doesn't matter what the replies are (NXDOMAIN is fine), or maybe you want a receipt confirmation encoded as an A or AAAA RR, whatever. You don't even need a tool because you can just script this from scratch every time you need this. The server could just log all the queries -- all you have to do is reassemble them. One could send junk queries to these domains to try to muck with such attacks, so maybe the attacker could add a label with a MAC to every query name. Really, this is unstoppable except via a) throttling, b) detecting this sort of thing, c) investigating detected attempts. (Or you can disallow direct DNS access to the Internet, forcing everything to go through proxies.)
- insanitybit 3y ago
  Yep, makes sense.

cryptonector 3y ago

Yes, it's putting the data into the name you're querying (the "qname" in DNS parlance). Say you have a message M of some length to exfiltrate, so first encode it as base64 or whatever, then break up the encoded message into chunks of 63 bytes (ASCII characters, since you encoded in base64), then send DNS lookups for ${n}.${chunk}.${some_label_identifying_exfiltration_instance}.${attacker_domain}. It doesn't matter what the replies are (NXDOMAIN is fine), or maybe you want a receipt confirmation encoded as an A or AAAA RR, whatever. You don't even need a tool because you can just script this from scratch every time you need this. The server could just log all the queries -- all you have to do is reassemble them. One could send junk queries to these domains to try to muck with such attacks, so maybe the attacker could add a label with a MAC to every query name. Really, this is unstoppable except via a) throttling, b) detecting this sort of thing, c) investigating detected attempts. (Or you can disallow direct DNS access to the Internet, forcing everything to go through proxies.)

insanitybit 3y ago
Yep, makes sense.