Exfiltrate Files Using the DNS

> Once upon a time, a government auditor insisted to me that keystroke loggers had to run as root, otherwise they would not function properly. So, I wrote a keystroke logger that ran as a normal user and showed it to him.

> He wasn’t amused. He said that I was violating government IT policy by demonstrating the program to him.

I once had a government inspector write us up because the secondary containment for our waste solvents was plastic, not stainless steel (the instruments emitted the solvents into glass containers, so this is just for spillage or minor overflows). I pointed out that these solvents were highly reactive with metals and our safety officer had specified plastic. She didn't care, so we got a ticket.

I went and got some stainless steel pans and placed the plastic containers inside them. Then I wrote back that I had purchased the steel pans and that the glass collection vessels were now enclosed with the steel pans. They canceled the ticket.

Generally I'm in favor of safety regulations but sometimes the enforcers are nuts. This was not the only such run in I've had.

Worth mentioning the Iodine project which allows for arbitrary IPv4 to be tunnelled over DNS, which can be useful on a few different restrictive networks.

https://code.kryo.se/iodine/

(I also like the naming pun; DNS running on port 53 with Iodine having the atomic number 53.)

For a variation of this technique see this handy privacy-preserving metrics collection golang library that uses DNS: https://github.com/Jigsaw-Code/choir

Currently used by the Jigsaw group at Google to collect metrics from behind censoring ISPs.

Thinkst Canary use DNS tunnelling to facilitate comms with honeypots. DNS tunnelling a great way to monitor activity on controlled access networks without opening ports and substantially expanding the attack surface.

https://help.canary.tools/hc/en-gb/articles/360002425837-Wha...

I think an allow-based DNS RPZ policy could potentially address this. If you could define the names that clients ought to talk to. It maybe a moving target, but worth trying.

https://tools.ietf.org/id/draft-vixie-dnsop-dns-rpz-00.html

https://lists.redbarn.org/pipermail/dnsfirewalls/2013-March/...

I had fun a few years ago bypassing captive portals using iodine to tunnel traffic over DNS. However, now that I'm professionally on the defensive side, this was one of the methods of data exfiltration that was really hard to block on AWS until recently. While GuardDuty may trigger on reckless usages of such approach, more cautious ones are slipping under the radar and preventing them implied replacing Route53 by a custom solution (pretty unpractical). Thankfully, AWS recently allowed access to Route53 logs (https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-wi...) that can be monitored to spot abnormal behavior.

WGET requests can also be used to exfiltrate data: https://miscdotgeek.com/curlytp-every-web-server-is-a-dead-d...

Along this line, it might be fun to set up an encrypted text chat server that uses this method. What records would work best, rrsig, txt?

This is also possible to do over the browser (just one-way communication, unfortunately) using dns-prefetch tags:

https://github.com/veggiedefender/browsertunnel

I saw a presentation at Schmoocon around 2005 where streaming video over DNS was demonstrated.