Dnsteal – DNS exfiltration tool for stealthily sending files over DNS requests | Hacker News Reader

Dnsteal – DNS exfiltration tool for stealthily sending files over DNS requests

github.com

53 pointsdhotson18 comments

It's a fun little program, but calling it stealthy is a reach. It seems to just extract a bytestream from the subdomain of the domain requested. Very easy to detect, very easy to see, and not much data can be xfered.

It's equally as "stealthy" as just sending requests to a domain you own and logging every request. e.g. mysite.com/<bytes>

I think it is stealthy since the data is not sent directly from the victim PC to the server, but rather the DNS server relays the file as a normal part of DNS recursion.

Since it looks like a normal DNS request, it is much harder to filter than sending out packets on monitored and easily proxied ports like 80 and 443.

I certainly wouldn't want to try and whitelist every DNS entry on the whole Internet...

I don't think it is possible to use recursion for this. At least not reliably, as its quite likely you will hit a cached record. Which means the file would not have been transferred completely to your authoritative server... (using some kind of counter could help though)

Simple enough to ensure each transfer uses both a unique transfer id and then a simple packet sequence number counter. This would ensure every request is unique.

Lots of big enterprises shops monitor http traffic (proxies, transparent and otherwise).. DNS is one of those left unmonitored usually..

I think your use of dots speaks for itself there ;). I know of several companies that log DNS, and it wouldn't pass inspection by a human operator which also has to be considered for something to be stealthy.

Lots of big enterprise shops monitor DNS too. OpenDNS (now Cisco) sells this as a service, lots of other security companies have tried to play catch up with various solutions.

more generally - ip over dns https://github.com/yarrick/iodine

Be extra careful running this code, the second line contains a stack smash attempt.

It's NOP in x86 asm and the guy's handle. https://twitter.com/_x90__

Or what is the second line to you?

Thanks.

You mean: # ~ \x90

What leads you to believe that's a stack smashing attempt?

I really hope you get an answer. I don't care that it's wrong, I want to hear why.

"I once saw '0x90' in an exploit. I see it in this file. This file must be an exploit."

And that's enough to get someone that almost never comments to post an alert? I hope it's at least a little more interesting than that.

http://blogs.msdn.com/b/oldnewthing/archive/2006/05/08/59235...

can you elaborate? is it exploiting a vulnerability in cpython? if so, what is it?

I do not believe this is exploiting a vulnerability in cpython.

Reply on news.ycombinator.com