6 ms·

File transfer via DNS

67 points by mariusz79 13y ago

nemasu 13y ago
Neat trick. But if you have to capture traffic on the server before sending anything, doesn't it make it kinda useless?
- bdunbar 13y ago
  Use case: Abe is able to shell into host A and host B. He wants to transfer a file to B but he's being watched by [NSA, SMERSH, his boss]. Not airtight, but ... something like that?
  - nemasu 13y ago
    Hmm, I would think scp would be way more secure if he can shell into both sessions? idk. There's probably a perfect use case out there somewhere. Still a neat trick, heck you could probably do it with any service, not just DNS, cause you're basically just capturing traffic to receive it...
  - mariusz79 13y ago
    "Better" use case - create a DNS client as a part of your Android/IOS app and send files from victim's computer to your own server :/
  - pfg 13y ago
    I'd guess the use case would be someone trying to send files through a network that's mostly locked down (think: corporate network using a transparent proxy for HTTP, etc), but allows outgoing DNS traffic.
    - userbinator 13y ago
      Been there, done that. A lot of public WiFi hotspots will allow outgoing (and incoming) DNS, by design. It's unbearably slow (especially when you use SSL over it, which I'd consider almost mandatory if you do this) for anything other than email and maybe running a few shell commands, however. Applying additional obfuscation/whitening to the data stream to make it harder to detect makes it even slower.
- jessaustin 13y ago
  Running a DNS server isn't inherently harder than running any other type of server. I think the point isn't to pwn any existing DNS server, but rather to hide communications from e.g. an IDS.
joaomsa 13y ago
Requests aren't guaranteed to be received in the same order to reassemble the files.
- sadfnjksdf 13y ago
  For the described technique, no. However, it would be easy enough for one request to have a different length hostname than the rest which contained a checksum, and if then try different combinations of the rest until it matched the checksum, which it would only need to do if it were out of order. And if that happened, you could increase the time between requests, to compensate.
  - jamiesonbecker 13y ago
    Or just add an incrementing prefix.
- wfn 13y ago
  edit whoops, hit the reply link under the wrong comment. This was supposed to be a comment under "This is a prime example of a covert communication channel." If anyone is interested in having more fun with this kind of stuff, take a look at Tor's pluggable transports[1], for example. A taste specimen of 'covert channels': * various 'have everything appear to be random TCP with no other marks' transports (+/- padded packet lengths, time intervals, etc.) * skype-look-alike transport * various-stuff-over-http-look-alike (html, etc) transport * a transport that imitates git's push/pull * a transport that, given enough 'permitted'/non-censored data, learns to imitate arbitrary protocols (learns and encodes them as regular expressions; some interesting and crazy CA madness) * etc. [1]: https://www.torproject.org/docs/pluggable-transports.html.en https://www.torproject.org/docs/pluggable-transports.html.en and https://trac.torproject.org/projects/tor/wiki/doc/PluggableTransports https://trac.torproject.org/projects/tor/wiki/doc/PluggableT...
jaytaylor 13y ago
This is a prime example of a covert communication channel [0]. [0] http://en.wikipedia.org/wiki/Covert_channel http://en.wikipedia.org/wiki/Covert_channel
bluedino 13y ago
You can tunnel all your traffic over DNS - http://code.kryo.se/iodine/ http://code.kryo.se/iodine/ Useful for hotspots that allow DNS but nothing else
- rahimnathwani 13y ago
  This is awesome, but I've found it usable only for very low bandwidth applications (like a remote terminal session). Web pages and emails are large these days :( If you're interested in IP-over-DNS, you may also be interested in IP-over-Facebook: https://news.ycombinator.com/item?id=7256477 https://news.ycombinator.com/item?id=7256477
- Daviey 13y ago
  Used to work well, but I've increasingly found that hotspots no longer provide DNS for free. :/
aashishkoirala 13y ago
If you're sending a non-trivial amount of data this way, won't the large number of consecutive fake DNS requests get noticed and draw attention?
- emidln 13y ago
  Who says they have to be fake? While a high number of requests for uncommon domains might trigger a lot of suspicion, you can cart out smaller amounts of data over DNS in ways that are really hard to detect. I've seen situations where data was being sent over DNS requests where the attacker merely held the ability to view the outgoing DNS traffic, but didn't really control (or want to risk modification) of traffic.
  - alexvay 13y ago
    Can you elaborate on this: where have you seen it? Was it a POC or in-the-wild?
- kjs3 13y ago
  It should, but it's unfortunately very rare to find a shop that looks for these kinds of covert channels. Most of the time DNS/ICMP/HTTP/etc are simply let through without logging or inspection.
zapman449 13y ago
Since most clients are supposed to work through a specified resolver rather than run their own, the easy block is to deny port 53 to non approved resolver hosts. Probably a good idea anyway in a secure environment, since it can potentially avoid cache poisoning if DNSSEC is setup right.
- icebraining 13y ago
  You can use the approved resolver. Just set up a DNS record delegating some subdomain to the fake DNS server, and then any unsuspecting resolver will work for you, sending the request upstream to the authoritative nameserver.
effdee 13y ago
Good ol' ping can also be used to send data. Some implementations support the -p flag which allows to send 16 bytes of user-defined data.
ChuckMcM 13y ago
This sort of abuse of protocols is pretty well used. A number of interesting port knockers are written using ping (ICMP echo). One of the more interesting to me was using the TTL value to pass hex nybbles. Implementation was up the ttl until your ping got through, then send your 'value' as ttl + value to your destination. It was limited mostly because you don't get that many hops generally. It is also negatively effected by path randomization but if you're willing to commit bits to forward error correction you can still get a message through. A lot of ping traffic through, shows up like most of these ideas in any shop with regular network monitoring.
ryan-c 13y ago
I made this a while ago, which turns the insanity up to about 13. https://github.com/ryancdotorg/dnsstore https://github.com/ryancdotorg/dnsstore
nuII 13y ago
What legit uses are there for this?
- piqufoh 13y ago
  The same 'legit' uses as for any other form of communication.
callesgg 13y ago
Plug for my own project: https://github.com/callesg/dns-tunnler https://github.com/callesg/dns-tunnler
ef47d35620c1 13y ago
Python code that does the same. Keeps the order of the file chunks too: http://16s.us/docs/dns.txt http://16s.us/docs/dns.txt

67 points by mariusz79 13y ago

nemasu 13y ago

Neat trick. But if you have to capture traffic on the server before sending anything, doesn't it make it kinda useless?

bdunbar 13y ago
Use case: Abe is able to shell into host A and host B. He wants to transfer a file to B but he's being watched by [NSA, SMERSH, his boss]. Not airtight, but ... something like that?
- nemasu 13y ago
  Hmm, I would think scp would be way more secure if he can shell into both sessions? idk. There's probably a perfect use case out there somewhere. Still a neat trick, heck you could probably do it with any service, not just DNS, cause you're basically just capturing traffic to receive it...
- mariusz79 13y ago
  "Better" use case - create a DNS client as a part of your Android/IOS app and send files from victim's computer to your own server :/
- pfg 13y ago
  I'd guess the use case would be someone trying to send files through a network that's mostly locked down (think: corporate network using a transparent proxy for HTTP, etc), but allows outgoing DNS traffic.
  - userbinator 13y ago
    Been there, done that. A lot of public WiFi hotspots will allow outgoing (and incoming) DNS, by design. It's unbearably slow (especially when you use SSL over it, which I'd consider almost mandatory if you do this) for anything other than email and maybe running a few shell commands, however. Applying additional obfuscation/whitening to the data stream to make it harder to detect makes it even slower.
jessaustin 13y ago
Running a DNS server isn't inherently harder than running any other type of server. I think the point isn't to pwn any existing DNS server, but rather to hide communications from e.g. an IDS.

joaomsa 13y ago

Requests aren't guaranteed to be received in the same order to reassemble the files.

sadfnjksdf 13y ago
For the described technique, no. However, it would be easy enough for one request to have a different length hostname than the rest which contained a checksum, and if then try different combinations of the rest until it matched the checksum, which it would only need to do if it were out of order. And if that happened, you could increase the time between requests, to compensate.
- jamiesonbecker 13y ago
  Or just add an incrementing prefix.
wfn 13y ago
edit whoops, hit the reply link under the wrong comment. This was supposed to be a comment under "This is a prime example of a covert communication channel." If anyone is interested in having more fun with this kind of stuff, take a look at Tor's pluggable transports[1], for example. A taste specimen of 'covert channels': * various 'have everything appear to be random TCP with no other marks' transports (+/- padded packet lengths, time intervals, etc.) * skype-look-alike transport * various-stuff-over-http-look-alike (html, etc) transport * a transport that imitates git's push/pull * a transport that, given enough 'permitted'/non-censored data, learns to imitate arbitrary protocols (learns and encodes them as regular expressions; some interesting and crazy CA madness) * etc. [1]: https://www.torproject.org/docs/pluggable-transports.html.en https://www.torproject.org/docs/pluggable-transports.html.en and https://trac.torproject.org/projects/tor/wiki/doc/PluggableTransports https://trac.torproject.org/projects/tor/wiki/doc/PluggableT...

jaytaylor 13y ago

This is a prime example of a covert communication channel [0]. [0] http://en.wikipedia.org/wiki/Covert_channel http://en.wikipedia.org/wiki/Covert_channel

bluedino 13y ago

You can tunnel all your traffic over DNS - http://code.kryo.se/iodine/ http://code.kryo.se/iodine/ Useful for hotspots that allow DNS but nothing else

rahimnathwani 13y ago
This is awesome, but I've found it usable only for very low bandwidth applications (like a remote terminal session). Web pages and emails are large these days :( If you're interested in IP-over-DNS, you may also be interested in IP-over-Facebook: https://news.ycombinator.com/item?id=7256477 https://news.ycombinator.com/item?id=7256477
Daviey 13y ago
Used to work well, but I've increasingly found that hotspots no longer provide DNS for free. :/

aashishkoirala 13y ago

If you're sending a non-trivial amount of data this way, won't the large number of consecutive fake DNS requests get noticed and draw attention?

emidln 13y ago
Who says they have to be fake? While a high number of requests for uncommon domains might trigger a lot of suspicion, you can cart out smaller amounts of data over DNS in ways that are really hard to detect. I've seen situations where data was being sent over DNS requests where the attacker merely held the ability to view the outgoing DNS traffic, but didn't really control (or want to risk modification) of traffic.
- alexvay 13y ago
  Can you elaborate on this: where have you seen it? Was it a POC or in-the-wild?
kjs3 13y ago
It should, but it's unfortunately very rare to find a shop that looks for these kinds of covert channels. Most of the time DNS/ICMP/HTTP/etc are simply let through without logging or inspection.

zapman449 13y ago

Since most clients are supposed to work through a specified resolver rather than run their own, the easy block is to deny port 53 to non approved resolver hosts. Probably a good idea anyway in a secure environment, since it can potentially avoid cache poisoning if DNSSEC is setup right.

icebraining 13y ago
You can use the approved resolver. Just set up a DNS record delegating some subdomain to the fake DNS server, and then any unsuspecting resolver will work for you, sending the request upstream to the authoritative nameserver.

effdee 13y ago

Good ol' ping can also be used to send data. Some implementations support the -p flag which allows to send 16 bytes of user-defined data.

ChuckMcM 13y ago

This sort of abuse of protocols is pretty well used. A number of interesting port knockers are written using ping (ICMP echo). One of the more interesting to me was using the TTL value to pass hex nybbles. Implementation was up the ttl until your ping got through, then send your 'value' as ttl + value to your destination. It was limited mostly because you don't get that many hops generally. It is also negatively effected by path randomization but if you're willing to commit bits to forward error correction you can still get a message through. A lot of ping traffic through, shows up like most of these ideas in any shop with regular network monitoring.

ryan-c 13y ago

I made this a while ago, which turns the insanity up to about 13. https://github.com/ryancdotorg/dnsstore https://github.com/ryancdotorg/dnsstore

nuII 13y ago

What legit uses are there for this?

piqufoh 13y ago
The same 'legit' uses as for any other form of communication.

callesgg 13y ago

Plug for my own project: https://github.com/callesg/dns-tunnler https://github.com/callesg/dns-tunnler

ef47d35620c1 13y ago

Python code that does the same. Keeps the order of the file chunks too: http://16s.us/docs/dns.txt http://16s.us/docs/dns.txt