{"id":1379,"date":"2021-05-20T09:00:27","date_gmt":"2021-05-20T06:00:27","guid":{"rendered":"https:\/\/macrosec.tech\/?p=1379"},"modified":"2021-05-16T19:49:56","modified_gmt":"2021-05-16T16:49:56","slug":"dns-tunneling-c2","status":"publish","type":"post","link":"https:\/\/macrosec.tech\/index.php\/2021\/05\/20\/dns-tunneling-c2\/","title":{"rendered":"DNS Tunneling for Defense Evasion and Command and Control"},"content":{"rendered":"

DNS TUNNELING FOR DEFENCE EVASION AND COMMAND AND CONTROL<\/span><\/strong><\/h2>\n<\/div>
\"Haystack<\/span><\/div><\/div><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/div>
<\/div>
<\/div>

This blog post was written by Alex Maina<\/a>.<\/p>\n<\/div>

<\/div>
<\/div><\/div>
<\/div>

Introduction<\/strong><\/h2>\n

Before we look at exploiting DNS through DNS tunneling we need to understand DNS and how it is critical to an organization\u2019s infrastructure.<\/p>\n

DNS is used to translate IP addresses into domain names.<\/p>\n

For example, if you type the URL, www.example.com in your browser it is the DNS that is responsible for converting the domain name to the relevant IP then displaying the content of the URL in the browser.<\/p>\n

More on DNS can be found here:<\/p>\n

DNS Explained – YouTube<\/a><\/p>\n

Why is this Important:<\/strong><\/h3>\n

The most notable ones are:<\/p>\n

    \n
  1. DNS is the only system that can help you browse the internet. Without DNS then the internet as we know it would not exist.<\/li>\n
  2. No need to memorize IP addresses \u2013 as DNS servers provide a solution for converting domain or subdomains to IP addresses.<\/li>\n<\/ol>\n

    This is very important for most organizations.<\/p>\n

    Hackers (blackhats) can also exploit DNS for malicious purposes as listed below as some of the disadvantages of DNS.<\/p>\n

    Disadvantages<\/strong><\/h3>\n
      \n
    1. DNS queries don\u2019t carry any information about the client who initiated it, this is very useful for blackhats as the server side will only see the IP address from where the query came from.<\/li>\n
    2. Another disadvantage is the way DNS servers are built an example is if the main server is broken or altered it will be hard to access the page that was hosted on the server (blackhats) can use this to their advantage by targeting the main servers of popular websites to redirect to users to malicious sites e.g. the watering-hole technique which has been used by several APTs as seen below to target popular websites.<\/li>\n<\/ol>\n

      More on this can be found here:<\/p>\n

      Drive-by Compromise, Technique T1189 – Enterprise | MITRE ATT&CK\u00ae<\/a><\/p>\n

       <\/p>\n

      Another method that an attacker can use is DNS to his advantage is through DNS tunneling for command and control, defense evasion and data exfiltration as it is not a highly monitored protocol by firewalls and disabling it could hinder usage of the internet<\/p>\n

       <\/p>\n

      DNS Tunneling<\/strong><\/h2>\n

      DNS tunneling is a nonstandard solution to exchange data using the DNS protocol.<\/p>\n

      There are different types of DNS Tunneling:<\/p>\n