DNS is a challenging protocol from a security perspective. We can’t simply block DNS communication due to its recursive nature. If a device needs to communicate with the internet, DNS is essential. Threat actors are well aware of this and often abuse DNS for malicious purposes in various ways.
DNS can be used to exfiltrate and infiltrate data. How is that possible? The technique is surprisingly simple and well-known.
Exfiltration
Let’s look at a basic example. Data can be encoded in base64, like this:
- IP Address: 9.8.7.6 (base64: OS44LjcuNg__)
- Hostname: Win7-home (base64: V2luNy1ob21l)
- Username: Harry Potter (base64: SGFycnkgUG90dGVy)
- System UUID: 246…XYZ (base64: MjQ24oCmWFla)
A compromised host then sends a DNS query for a subdomain like:
OS44LjcuNg__-V2luNy1ob21l-SGFycnkgUG90dGVy-MjQ24oCmWFla.badsite.com
The threat actor, who owns the badsite.com domain, sees the DNS query from the infected system and performs base64 decoding to retrieve the original information (IP address, hostname, username, etc.).
Using the same method, threat actors can exfiltrate not only metadata, but also actual files and documents — chunk by chunk.
Infiltration
Infiltration works the same way, but in reverse.
Using TXT records, attackers can store up to 1024 characters of base64-encoded data. When the compromised host queries the DNS server for TXT records, it decodes the response from base64 to UTF-8. In this way, malicious payloads—such as malware—can be delivered directly to the endpoint via DNS.
What About Network Security Products?
How well do modern security products protect against DNS tunneling?
In my lab environment, I tested solutions from Palo Alto NGFW, FortiGate, and Cisco Umbrella. Each vendor claims to have DNS tunneling protection. But how effective is it really?
Test Methodology
There are many well-known tools for DNS tunneling, such as Iodine. However, to make detection harder for security products, I decided to develop my own tool. In fact, I used ChatGPT to help generate some PowerShell scripts tailored to my needs.
For testing purposes, I used my own domain, letsnet.eu, which has a good reputation—making it more difficult for security tools to flag DNS tunneling activity.
Curious About the Results?
Want to know how effective these solutions really are in detecting and stopping DNS tunneling?
Stay tuned—I’ll be publishing the results soon.