Visibility, visibility and visibility. Crucial and basic thing to secure infrastructure, if you cannot see something, than you cannot protect as well.
DNS protocol is quite challenging from security perspective, it’s like phone book of Internet and cannot be blocked. DNS server has to have communications with external DNS server and that is enough to use DNS service for malicious purposes. Using only properly crafted DNS queries threat actors can exfiltrate data or use it as command and control communications channel.
DNS Tunneling
How it’s working? The client sends DNS packets to the internet, encodes content through DNS queries and decodes content from DNS responses. The server receives DNS queries from recursive resolvers, decodes content from DNS queries and encodes content as DNS responses.
Above figure illustrates this process at a high level. In this example, the client first encodes data (IP Address, hostname, username, etc) into base64 and sends DNS query to badsite.com. Threat actor is an owner of badsite.com authoritative DNS server, because of recursive nature of DNS service, he will receive that query. Than using reverse process, threat actor decodes base64 to UTF-8 and can see data. Its is just example, used rather for reconnaissance purposes, the same technic can be used to exfiltrate or infiltrate data and for c2c communications as well.
There are ready-to-use DNS tunneling tools, open-source applications such as iodine, DNSStager, dnscat2 and sliver or proprietary ones such as Cobalt Strike. These tools support encoding generic messages as subdomains of DNS queries and as various types of DNS responses, such as A (IPv4 address), AAAA (IPv6 address), TXT, CNAME and MX.
DoH/DoT
DNS is clear text protocol, uses TCP/UDP port 53, so inspetion of DNS traffic require only specific tool, firewall or something dedicated to inspect DNS. There are also encrypted versions of DNS protocol, DoH – DNS over HTTPS (TCP port 443) and DoT – DNS over TLS (TCP port 853). Here we can find DNS statistics of encrypted queries to CloudFlare DNS open servers:
https://stats.labs.apnic.net/edns
For instance in Poland, 10% of DNS traffic is encrypted, 10% lack of visibility if you don’t care about DoH/DoT traffic. These are global statistics, how it looks like in real corporate environment, around 8k endpoints:
This report is for last 7 days, like we see, a lot of DNS queries without any control and inspection.
What to do with DoH/DoT?
DNS traffic inspection is a must, there are 2 options to support securely encrypted DNS queries:
- Implement decryption:
- DoT – decrypt traffic on port tcp 853
- DoH – uses port tcp 443, it’s rare case when whole https traffic is about to decrypt, so here even when decryption is implemented, as best practise block DoH as well
- Block DoH/DoT and the clients should fall back to regular DNS requests (not every UTM/NGFW supports it in easy way).