Tunneling Data and Commands Over DNS to Bypass Firewalls • Hacker News Board

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#11

Post by dvt » Sun, Jul 12, 2015, 8:02 PM UTC

huhtenberg wrote: post #6

gwillen wrote: post #5

Earlier quoted context omitted.

You can bypass essentially all paywalls using DNS tunnelling. The connection you get has _terrible_ bandwidth and latency characteristics, which is why nobody does it.

Not entirely correct. This doesn't work for many hotel paywalls, because they would have a catch-all rule for all DNS A queries (resolving to a local IP of authenticating proxy) and block everything else. And the reason is exactly because of the DNS tunneling, which was making rounds in p2p circles as far back as 2005 if not earlier.

Very interesting, +1 for the knowledge drop.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#12

Post by jkot » Sun, Jul 12, 2015, 8:10 PM UTC

One mobile operator in central europe allows ICMP on all phones...

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#13

Post by jbuzbee » Sun, Jul 12, 2015, 8:27 PM UTC

From reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and lots of unique subhosts at the controlled DNS server, e.g. many queries of hosts like: 19c301abcddeadbeef.malware.com.

It seems like this pattern could be recognized behind the firewall. How often would a real Internet client resolve hundreds or thousands of sub-hosts in a short timeframe?

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#14

Post by TheLoneWolfling » Sun, Jul 12, 2015, 9:37 PM UTC

jbuzbee wrote: post #13

From reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and lots of unique subhosts at the controlled DNS server, e.g. many queries of hosts like: 19c301abcddeadbeef.malware.com. It seems like this pattern could be recognized behind the firewall. How often would a real Internet client resolve hundreds or thousands of su…

Relatively often, actually.

For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084

It loads .cloudfront.net - and it changes every reload for me. For instance, d262ilb51hltx0.cloudfront.net, dnqgz544uhbo8.cloudfront.net, d262ilb51hltx0.cloudfront.net.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#15

Post by buserror » Sun, Jul 12, 2015, 9:49 PM UTC

mayli wrote: post #3

I've been using iodine http://code.kryo.se/iodine/ for a long time.

Ah, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#16

Post by gst » Sun, Jul 12, 2015, 9:50 PM UTC

auganov wrote: post #10

gwillen wrote: post #5

Earlier quoted context omitted.

You can bypass essentially all paywalls using DNS tunnelling. The connection you get has _terrible_ bandwidth and latency characteristics, which is why nobody does it.

Yea, it was pretty bad for me. I did manage to establish an ssh connection over that, but it would get dropped pretty fast. I'd setup L2TP on the host if you want to browse the web, it might just about work. The connection itself is not that bad, I actually paid for it eventually and it was okayish. I'm pretty sure with a bunch of adjustments you could get it to a point where you can use some IM comfortably.

Mosh (https://mosh.mit.edu/) might work better than TCP-based SSH connections for such a setup.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#17

Post by chrismsnz » Sun, Jul 12, 2015, 9:55 PM UTC

buserror wrote: post #15

mayli wrote: post #3

I've been using iodine http://code.kryo.se/iodine/ for a long time.

Ah, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...

Circumventing your companies firewall is not a great idea in the first place.

Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#18

Post by jbuzbee » Sun, Jul 12, 2015, 9:57 PM UTC

TheLoneWolfling wrote: post #14

jbuzbee wrote: post #13

From reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and lots of unique subhosts at the controlled DNS server, e.g. many queries of hosts like: 19c301abcddeadbeef.malware.com. It seems like this pattern could be recognized behind the firewall. How often would a real Internet client resolve hundreds or thousands of su…

Relatively often, actually. For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084 It loads .cloudfront.net - and it changes every reload for me. For instance, d262ilb51hltx0.cloudfront.net, dnqgz544uhbo8.cloudfront.net, d262ilb51hltx0.cloudfront.net.

That seems a bit different. A unique subdomain for each web page load might be common, but from my reading of the article, it looks like every packet of the tunneled conversation gets a unique domain. So for transferring any amount of data, I'd expect to see hundreds (thousands?) of subdomain resolution queries in a few minutes. That could raise a red flag.

I suppose if the malware wanted to be more stealthy, it could slow transfers way down, intermix unrelated queries and spread the tunnel across multiple unrelated controlled domains.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#19

Post by TheLoneWolfling » Sun, Jul 12, 2015, 10:17 PM UTC

jbuzbee wrote: post #18

TheLoneWolfling wrote: post #14

Earlier quoted context omitted.

Relatively often, actually. For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084 It loads .cloudfront.net - and it changes every reload for me. For instance, d262ilb51hltx0.cloudfront.net, dnqgz544uhbo8.cloudfront.net, d262ilb51hltx0.cloudfront.net.

That seems a bit different. A unique subdomain for each web page load might be common, but from my reading of the article, it looks like every packet of the tunneled conversation gets a unique domain. So for transferring any amount of data, I'd expect to see hundreds (thousands?) of subdomain resolution queries in a few minutes. That could raise a red flag. I suppose if the malware wanted to be more stealthy, it coul…

As you said, you can do slow data transfer extremely easily and stealthily with this method. Bulk data transfer, not so much.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#20

Post by samdroid » Sun, Jul 12, 2015, 10:19 PM UTC

dvt wrote: post #2

Don't tell anyone, but I did this on a plane ;) It was fickle, but I imagine you could build an entire protocol on top of DNS.

The adobe air based VPNoverDNS app [1] works pretty well. You can set up port forwarding for irc and SSH.

Iodine seems to be a bit more complex as the default configuration doesn't work in that environment.

[1] https://play.google.com/store/apps/details?id=air.com.mail4h...