4 ms·
If you're sending a non-trivial amount of data this way, won't the large number of consecutive fake DNS requests get noticed and draw attention?
by aashishkoirala 13y ago
If you're sending a non-trivial amount of data this way, won't the large number of consecutive fake DNS requests get noticed and draw attention?
- emidln 13y agoWho says they have to be fake? While a high number of requests for uncommon domains might trigger a lot of suspicion, you can cart out smaller amounts of data over DNS in ways that are really hard to detect. I've seen situations where data was being sent over DNS requests where the attacker merely held the ability to view the outgoing DNS traffic, but didn't really control (or want to risk modification) of traffic.
- alexvay 13y agoCan you elaborate on this: where have you seen it? Was it a POC or in-the-wild?
- kjs3 13y agoIt should, but it's unfortunately very rare to find a shop that looks for these kinds of covert channels. Most of the time DNS/ICMP/HTTP/etc are simply let through without logging or inspection.