10 ms·
Images over DNS
- cyanmagenta 1y agoThe cap for record size is 64KB, but you can have an arbitrary number of records, so larger images should be possible by combining multiple TXT record responses into one.
- dgl 1y agoI put a link to[1] in the article, which was previously discussed here[2] with a correction to that article. Basically there's a 2 byte length header on TCP DNS responses, limiting the payload (i.e. the DNS message inside) to 64 KiB. [1]: https://www.netmeister.org/blog/dns-size.html#:~:text=65536%20bytes%20DNS%20payload%20%2B%202%20bytes%20size%20%3D%2065538%20bytes [2]: https://news.ycombinator.com/item?id=39257147
- KPGv2 1y agoAlso with EDNS0, you can send larger messages over UDP, too, because you aren't restricted to a single UDP payload, but can send multiple datagrams. It's pretty cool how this tech has evolved. UDP has become so much more reliable that you can even do SSL over UDP, with a complex mechanism meant to account for dropped packets during the handshake process.
- m3047 1y agoAfter many years of "4096 ought to be enough for anybody", the default max UDP size in BIND 9 was reduced to 1232. Frags are bad; jumbos are good, but frags are bad!
- cyanmagenta 1y agoRight, but you aren’t limited to one DNS call. You could have the javascript resolve multiple text records, then combine them together. You could even do this over UDP if you really wanted, just merging a bunch of 1200-byte records together
- m3047 1y agoA DNS message cannot exceed 64K, but multiple messages can be transmitted over TCP. That's the way AXFR (zone transfer) is done: one question, multiple responses. https://github.com/m3047/rear_view_rpz/blob/b17cf943ccd7498d8f31671f24c742d570af78fb/python/rearview/rpz.py#L349 https://github.com/m3047/rear_view_rpz/blob/b17cf943ccd7498d...
- hhh 1y agoVery cool. I have done similar for playing Bad Apple as well as Doom over DNS: https://youtu.be/AJ2Q12vYojY https://youtu.be/AJ2Q12vYojY https://youtu.be/GoPWuJR6Npc https://youtu.be/GoPWuJR6Npc
- dgl 1y agoCool! For the bad apple one; I tried something like that, it works if you're directly querying the authoritative DNS server, but if a cache is involved the records will be re-ordered by randomisation (even in some cases with TTL=0). That's why I ended up doing this as a single very long record, because then it can be cached without worrying about reordering.
- mycall 1y agoThe wild part of DNS is that port 53 is typically open on firewalls and is excellent for data exfiltration/infiltration.
- nenenejej 1y agoIs it? Most firewalls I see allow no inbound by default (although all outbound)
- NegativeK 1y agoI assume they were referring to outbound. But ideally it'd be blocked and all traffic would go through an internal caching resolver, right? To reduce internal latency and load on outside servers, but also to have records if needed and to block whack requests or responses if needed.
- lormayna 1y agoIn a corporate environment you must use only the company DNS internal resolver and they are the only one that should go outside on port 53. This is a basic security measure to detect and block every attempt of DNS tunnelling or exfiltration
- tuwtuwtuwtuw 1y agoEven if you use the internal resolver you could exfiltrate the data.
- alamzin 1y agoYes, but why? :)
- jama211 1y agoFUN! And who knows, maybe this will lead to something later. Many discoveries or inventions were built on things people didn’t know the use of at the time.
- rvz 1y agoExactly.
- CaptainOfCoit 1y agoBetter question: Why not? :)
- HeckFeck 1y agoBecause I want my DKIM signatures to be literal signatures.
- rvz 1y agoWhy not? This is exactly what hackers and tinkerers do.
- boznz 1y agoQuestion can also be interpreted as "why does DNS even allow this" which is fair as it only purpose should be to convert a domain name address into a 32 bit number. The answer is partially in the link on TFA. I guess they had their reasons.
- pixl97 1y agoI mean DNS has had different record types for as long as I can remember, txt records in specific allowed the protocol to be extensible without everyone having to update their software to support new record types. And that also leaves out the common things like MX records.
- rany_ 1y agoThe image is actually HEIF not AVIF :)
- zamadatix 1y agoHEIF is just the usual container for AVIF encoded data, similar to how AV1 encoded data might commonly be in an MP4 or MKV container. HEIF might easily get conflated with HEIC, which is Apple's implementation of HEIF specifically for HEVC encoded data. Too many damn "HE"s, if you ask me. If you run "strings" you should see "av01Image" pretty early on in the HEIF header, which is what signals it's really an AVIF file. Tools like "file" may possibly not be updated to look for that yet, so could just report the container alone.
- dgl 1y agoTo be fair I did lazily do: else if (c.slice(4, 4+4) == "ftyp") f="avif"; Because I didn't feel like parsing the HEIF to check it's actually AVIF. I'm pretty sure browsers aren't that bothered about the file extension or MIME type for images.
- rany_ 1y agoHuh, my image viewer claimed it's HEIC specifically. My camera also seems to conflate HEIC and HEIF in the settings. It provides HEIF as a format option, when I guess it should be specifying which codec is actually being used. I had no idea HEIF isn't tied to just HEIC though.
- r721 1y agoI wonder is it possible to create a HN clone over DNS?
- deoxykev 1y agoHow about LLM chat over DNS? https://github.com/accupham/llm-dns-proxy https://github.com/accupham/llm-dns-proxy
- mrb 1y agoOh, this reminds me of a Chrome extension I wrote to distribute Web content (images, html, js, anything) over DNS: https://blog.zorinaq.com/cdn53-a-super-distributed-cdn/ https://blog.zorinaq.com/cdn53-a-super-distributed-cdn/ It implements the fake TLD .cdn53: when visiting http://zorinaq.com.cdn53 http://zorinaq.com.cdn53 the extension intercepts the request, sends a DNS query for the TXT record for "_cdn53.zorinaq.com" and the response contains the HTML content, or any content, and it can be up to ~65 kb in size. It's super-distributed as it will naturally be cached by all DNS resolvers worldwide that hit the domain...
- vitonsky 1y agoGood idea. Probably nowadays this would not work due to changes in chrome extension API? They have limit a network interception API.
- BuildTheRobots 1y agoThere's also the Iodine project if you want to tunnel raw IPv4 over DNS [53] [53] https://github.com/yarrick/iodine https://github.com/yarrick/iodine
- mmh0000 1y agoI love iodine. I used to do a lot of consulting work at locations with extremely locked down networks. I could use iodine + wireguard to punch through most firewalls, slow, but effective.
- lormayna 1y agoThis means that the security department is not doing a good job: things like iodine can be detected easily by a NGFW or by an analysis on DNS logs. This is a quite basic security posture.
- EvanAnderson 1y agoBack when I was using it similarly to the other poster (say, 15 years ago) that wasn't the case. It's still a great litmus test of security posture today. Just using DNS for data exfiltration, in general, is usually pretty fruitful. I wrote a "live off the land" data exfil script for Windows once, using the certutil and nslookup commands to base64 encode data and ship it out to my off-site DNS server. I'll have to try it against a Palo Alto NGFW sometime and see what alarms I trip. I honestly never thought to try.
- lormayna 1y agoThat's make sense 15 years ago. Right now even the SOHO appliances have the DNS inspection feature.
- bongodongobob 1y agoLol no it isn't. Most companies don't even have MFA across the board, much less do anything with DNS security beyond maybe a blacklist.
- notepad0x90 1y agoThis is cool and all but due to malicious actors abusing this avenue, firewalls as well as endpoint agents will detect and block this. If you create a serious solution that uses this that is, it's great for home use and experimentation I guess.
- SaggyDoomSr 1y agoI worked in the networking group for a cloud computing company. You've heard of them. We didn't charge for (some) DNS traffic, so some customers figured out how to use DNS as a transport mechanism to skirt around paying data transfer fees. It would essentially be a DoS attack which affected EVERY customer, so a few could save tiny fractions of their overall spend. A peer team of mine had to deal with the mess. That team had > 100% annual staff turnover, because they just made the oncall staff deal with the problem every time it showed up rather than ever solve the core issue of having a DoS vector masquerading as a feature.
- zoky 1y agoWouldn’t the solution be to just start charging for excessive DNS traffic?
- lelandbatey 1y agoPotentially yes, but that's a business decision which the on-call developer cannot deal make on behalf of the business.
- canttestthis 1y agoThere's a lot of stuff the dev team can do that are not strictly business decisions though. Rate limits, QoS, etc.
- rapind 1y agoThose can be business decisions too though. It depends on whether or not the real / lucrative customers will notice, or maybe the noisy customers who will be all over twitter because a dev figured they'd make a big change like this on their own. Throttling and tiering can definitely affect more people than you might suspect (like spiky services) and considering data and use are important.
- gitaarik 1y agoYou can also create a REST API that accepts domain names and returns IP addresses! Then you can make a webserver that uses the REST API to get the IP address of the image you want to display!
- jedisct1 1y agoImages over DNS over DNSCrypt over a DNS relay accessed via a VPN acting as a gateway to Tor. Maximum security.