5 ms·
Tunneling Data and Commands Over DNS to Bypass Firewalls
- dvt 11y agoDon't tell anyone, but I did this on a plane ;) It was fickle, but I imagine you could build an entire protocol on top of DNS.
- gruez 11y agowait, you could bypass the inflight wifi's paywall by using dns tunneling?
- gwillen 11y agoYou can bypass essentially all paywalls using DNS tunnelling. The connection you get has _terrible_ bandwidth and latency characteristics, which is why nobody does it.
- huhtenberg 11y agoNot entirely correct. This doesn't work for many hotel paywalls, because they would have a catch-all rule for all DNS A queries (resolving to a local IP of authenticating proxy) and block everything else. And the reason is exactly because of the DNS tunneling, which was making rounds in p2p circles as far back as 2005 if not earlier.
- dvt 11y agoVery interesting, +1 for the knowledge drop.
- cfallin 11y agoDoesn't this cause issues with cached bogus A records once the user pays and is granted access? I suppose you could return really short TTLs, but there would still be a delay of at least a few seconds. (I'm not doubting they do this, just saying it seems very hacky...)
- detaro 11y agoYes, it does, and of course fails if the site called is https. AFAIK some implementations work as a proxy after successful authentication to reduce that problem. Other solutions use proxy configuration detection to redirect people to a proxy that first asks for authentication/payment. (wpad file) Both solutions are kind of hacky, but they work for more or less all devices.
- codexon 11y agoLast time I checked which was about 2 years ago, I've started seeing paywalls that blocked DNS.
- auganov 11y agoYea, it was pretty bad for me. I did manage to establish an ssh connection over that, but it would get dropped pretty fast. I'd setup L2TP on the host if you want to browse the web, it might just about work. The connection itself is not that bad, I actually paid for it eventually and it was okayish. I'm pretty sure with a bunch of adjustments you could get it to a point where you can use some IM comfortably.
- gst 11y agoMosh (https://mosh.mit.edu/ https://mosh.mit.edu/) might work better than TCP-based SSH connections for such a setup.
- dvt 11y agoYep!
- samdroid 11y agoThe adobe air based VPNoverDNS app [1] works pretty well. You can set up port forwarding for irc and SSH. Iodine seems to be a bit more complex as the default configuration doesn't work in that environment. [1] https://play.google.com/store/apps/details?id=air.com.mail4hotspot&hl=en&referrer=utm_source%3Dgoogle%26utm_medium%3Dorganic%26utm_term%3Dvpnoverdns&pcampaignid=APPU_1_GOeiVdulDcPsmAWjhoDwDA https://play.google.com/store/apps/details?id=air.com.mail4h...
- mayli 11y agoI've been using iodine http://code.kryo.se/iodine/ http://code.kryo.se/iodine/ for a long time.
- buserror 11y agoAh, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...
- chrismsnz 11y agoCircumventing your companies firewall is not a great idea in the first place. Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.
- buserror 11y agoWell I hope they don't proxy the DNS -- it's quite costly to do so, if they don't it'll be fine. If they do, well, I'll have to find another way using 'long' http transactions and such...
- chrismsnz 11y agoRunning an internal DNS resolver is actually very cheap, almost every broadband CPE device runs or can run its own DNS proxy resolver. It's also a great source of information when monitoring egress communication, so I would just make sure you know what you're doing.
- hueving 11y agoWhy would you think that's costly? A cheap home router can do it with dnsmasq.
- JoshTriplett 11y ago
- deleted 11y ago[deleted]
- jkot 11y agoOne mobile operator in central europe allows ICMP on all phones...
- slirpee 11y agoI was tinkering with DNS tunneling for free mobile internet, and found that TCP port 53 was apparently unfettered. (Other traffic I tried was firewalled, and HTTP was captured and redirected to a page prompting to buy a data plan.) I guess the intention was for DNS over TCP, but I was able to ssh over that port and got decent speeds and no apparent tampering of the traffic.
- jbuzbee 11y agoFrom reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and lots of unique subhosts at the controlled DNS server, e.g. many queries of hosts like: 19c301abcddeadbeef.malware.com. It seems like this pattern could be recognized behind the firewall. How often would a real Internet client resolve hundreds or thousands of sub-hosts in a short timeframe?
- TheLoneWolfling 11y agoRelatively often, actually. For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084 https://medium.com/@bchesky/7-rejections-7d894cbaa084 It loads <some random subdomain>.cloudfront.net - and it changes every reload for me. For instance, d262ilb51hltx0.cloudfront.net, dnqgz544uhbo8.cloudfront.net, d262ilb51hltx0.cloudfront.net.
- jbuzbee 11y agoThat seems a bit different. A unique subdomain for each web page load might be common, but from my reading of the article, it looks like every packet of the tunneled conversation gets a unique domain. So for transferring any amount of data, I'd expect to see hundreds (thousands?) of subdomain resolution queries in a few minutes. That could raise a red flag. I suppose if the malware wanted to be more stealthy, it could slow transfers way down, intermix unrelated queries and spread the tunnel across multiple unrelated controlled domains.
- TheLoneWolfling 11y agoAs you said, you can do slow data transfer extremely easily and stealthily with this method. Bulk data transfer, not so much.