Show HN: Use DNS TXT to share information • Hacker News Board

Re: Show HN: Use DNS TXT to share information

#21

Post by madmax108 » Mon, Jul 17, 2023, 11:43 AM UTC

It's always amusing to see DNS "hackery"[1] like this, and always makes me go back to DNS Toys (https://www.dns.toys/), which generated a huge discussion on HN a year ago [2]

---

[1] well, it's not really hackery if you're being pedantic, since it's doing what the spec allows it to do

[2] DNS Toys (946 points): https://news.ycombinator.com/item?id=31704789

Re: Show HN: Use DNS TXT to share information

#22

Post by EnglishLFC » Mon, Jul 17, 2023, 12:17 PM UTC

It's always amusing when someone discovers DNS TXT records. ClamAV has been using them to announce the latest versions for more years than I care to remember.

$ dig +short -t txt current.cvd.clamav.net "0.103.8:62:26972:1689593340:1:90:49192:334"

For anyone interested, Freshclam interprets this as:

Latest ClamAV version: 0.103.8 Latest Main DB version: 62 Latest Daily DB version: 26972 UNIX Timestamp 1689593340

...and then some other version numbers and things I don't remember, one is probably a bytecode DB version 334, f-level 90 maybe.

Anyway, nothing new, works as designed. You can do all kinds of neat tricks with it. DNS has a lot going on that most people don't (ab)use.

Re: Show HN: Use DNS TXT to share information

#23

Post by breakingcups » Mon, Jul 17, 2023, 12:19 PM UTC

DPI will make short work of your unencrypted DNS records..

Re: Show HN: Use DNS TXT to share information

#24

Post by contravariant » Mon, Jul 17, 2023, 12:32 PM UTC

c7DJTLrn wrote: post #13

Hnrobert42 wrote: post #8

The iodine protocol allows bi-directional ipv4 traffic over DNS. https://github.com/yarrick/iodine

This is pretty good for bypassing captive portals on public Wi-Fi access points. Sometimes you can use it to get Internet for free without paying. These days most are more clever and will block everything other than the default gateway until you sign on.

Don't most of them hijack any DNS traffic to send it to their own portal?

Re: Show HN: Use DNS TXT to share information

#25

Post by exabrial » Mon, Jul 17, 2023, 12:47 PM UTC

If only we could put TCP port numbers in DNS to avert an ipv4 availability crunch and effectively expand the address space to 48bits… one can dream. Apparently impossible.

Re: Show HN: Use DNS TXT to share information

#26

Post by exabrial » Mon, Jul 17, 2023, 12:49 PM UTC

PinguTS wrote: post #12

candiddevmike wrote: post #4

Relying on DNS is not recommended when under severe censorship

Why, if it is encrypted?

It’s impossibly easy to block resolution of txt records, for instance.

Re: Show HN: Use DNS TXT to share information

#27

Post by hannob » Mon, Jul 17, 2023, 12:51 PM UTC

EnglishLFC wrote: post #22

It's always amusing when someone discovers DNS TXT records. ClamAV has been using them to announce the latest versions for more years than I care to remember. $ dig +short -t txt current.cvd.clamav.net "0.103.8:62:26972:1689593340:1:90:49192:334" For anyone interested, Freshclam interprets this as: Latest ClamAV version: 0.103.8 Latest Main DB version: 62 Latest Daily DB version: 26972 UNIX Timestamp 1689593340 ...an…

That is... interesting that they do not even use HTTPS or any type of signature for that info.

So a man in the middle could prevent updates from happening, and freshclam wouldn't even throw a warning?

Re: Show HN: Use DNS TXT to share information

#28

Post by threesevenths » Mon, Jul 17, 2023, 12:56 PM UTC

exabrial wrote: post #25

If only we could put TCP port numbers in DNS to avert an ipv4 availability crunch and effectively expand the address space to 48bits… one can dream. Apparently impossible.

You can they are called SRV records but browsers don’t really support lookups that way.

Re: Show HN: Use DNS TXT to share information

#29

Post by CrLf » Mon, Jul 17, 2023, 12:57 PM UTC

exabrial wrote: post #25

If only we could put TCP port numbers in DNS to avert an ipv4 availability crunch and effectively expand the address space to 48bits… one can dream. Apparently impossible.

Do you mean SRV records?

https://www.cloudflare.com/learning/dns/dns-records/dns-srv-...

Re: Show HN: Use DNS TXT to share information

#30

Post by _8j50 » Mon, Jul 17, 2023, 1:12 PM UTC

OP, this is trivial to detect. DNS command and control is a thing malware/attackers use which among other things include TXT records,DoH, long A or AAAA records and many other creative ways, my fav right now being using a CNAME chain to encode information (no single request is too large or suspicious.

In my experience, bypassing censorship does not mean doing unusual things like this but things like browser extenstions that stego your message in legitimate requests .