3 ms·
From reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and l
by jbuzbee 11y ago
From reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and lots of unique subhosts at the controlled DNS server, e.g. many queries of hosts like: 19c301abcddeadbeef.malware.com.
It seems like this pattern could be recognized behind the firewall. How often would a real Internet client resolve hundreds or thousands of sub-hosts in a short timeframe?
- TheLoneWolfling 11y agoRelatively often, actually. For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084 https://medium.com/@bchesky/7-rejections-7d894cbaa084 It loads <some random subdomain>.cloudfront.net - and it changes every reload for me. For instance, d262ilb51hltx0.cloudfront.net, dnqgz544uhbo8.cloudfront.net, d262ilb51hltx0.cloudfront.net.
- jbuzbee 11y agoThat seems a bit different. A unique subdomain for each web page load might be common, but from my reading of the article, it looks like every packet of the tunneled conversation gets a unique domain. So for transferring any amount of data, I'd expect to see hundreds (thousands?) of subdomain resolution queries in a few minutes. That could raise a red flag. I suppose if the malware wanted to be more stealthy, it could slow transfers way down, intermix unrelated queries and spread the tunnel across multiple unrelated controlled domains.
- TheLoneWolfling 11y agoAs you said, you can do slow data transfer extremely easily and stealthily with this method. Bulk data transfer, not so much.