Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tunneling Data and Commands Over DNS to Bypass Firewalls

zeltser.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#31

Post by JoshTriplett »

chrismsnz wrote: post #26
JoshTriplett wrote: post #25

Earlier quoted context omitted.

> Circumventing your companies firewall is not a great idea in the first place. Neither is putting in place a firewall that makes people need to circumvent it to get their jobs done. If you work at the NSA, sure, it makes sense that all access is heavily restricted. (Though if you work at the NSA, please reconsider what you're doing with your life.) But if you work at an ordinary company, and doing your job (note: no…

I'm a security guy so I obviously have a differing viewpoint, but when it comes to ensuring what data comes in and leaves your environment there's little choice. The ability to analyse outgoing traffic is really a requirement for being able to effectively detect and respond to incidents. If your job involves idling on Freenode maybe take it up with management? EDIT: phrasing

First, security is never a goal in itself; the goal is to get some job done, which involves having something to protect, and security's job is to protect it.

Second, even when your metric is security, creating a policy that people have to circumvent to get their job done seems likely to reduce security.

> when it comes to ensuring what data comes in and leaves your environment there's little choice

The concept of your environment having an "inside" and an "outside" is dangerous. Better to assume that "inside" is just as hostile as "outside", and avoid having any insecure internal services or resources. Use TLS/HTTPS everywhere internally, require authentication for internal services, and otherwise make sure that an attacker gains nothing by compromising an end-user system except what's on that end-user system.

> If your job involves idling on Freenode

Forget "idling"; participating effectively in many Open Source projects (whether developing them or getting support for them) requires the ability to get on IRC.

> maybe take it up with management

Short of C-level executives, management rarely has the ability to change IT policy.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#32

Post by chrismsnz »

JoshTriplett wrote: post #31
chrismsnz wrote: post #26

Earlier quoted context omitted.

I'm a security guy so I obviously have a differing viewpoint, but when it comes to ensuring what data comes in and leaves your environment there's little choice. The ability to analyse outgoing traffic is really a requirement for being able to effectively detect and respond to incidents. If your job involves idling on Freenode maybe take it up with management? EDIT: phrasing

First, security is never a goal in itself; the goal is to get some job done, which involves having something to protect, and security's job is to protect it. Second, even when your metric is security, creating a policy that people have to circumvent to get their job done seems likely to reduce security. > when it comes to ensuring what data comes in and leaves your environment there's little choice The concept of you…

I guess the goal of Security is to not become the next OPM or Hacking Team.

I agree with what you say regarding perimeter security, a concept quickly decreasing in relevance in today's environments. Unfortunately, when you have thousands of people working for you that don't know how to computer, you have to take steps to ensure that the data and functionality that they're handling remains protected.

Additionally, a large amount of attack surface exists on the client side, and with these two factors at play you're dealing with a lot of non-trivial trust relationships within your organisation.

Yes, ideally every system would be an island, and everyone who was supposed to operate it could do so securely and competently enough that they'd realise if something was wrong.

Until then, corporate workstations live in a locked down world where all external access is monitored and scrutinised.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#33

Post by jac_no_k »

JoshTriplett wrote: post #31
chrismsnz wrote: post #26

Earlier quoted context omitted.

I'm a security guy so I obviously have a differing viewpoint, but when it comes to ensuring what data comes in and leaves your environment there's little choice. The ability to analyse outgoing traffic is really a requirement for being able to effectively detect and respond to incidents. If your job involves idling on Freenode maybe take it up with management? EDIT: phrasing

First, security is never a goal in itself; the goal is to get some job done, which involves having something to protect, and security's job is to protect it. Second, even when your metric is security, creating a policy that people have to circumvent to get their job done seems likely to reduce security. > when it comes to ensuring what data comes in and leaves your environment there's little choice The concept of you…

If getting the job done requires exceptional access outside what is allowed by the firewall, a formal exception should be sought. Perhaps there is a solution to put a workstation separate from the corporate network? Maybe it's time to take up the management banner charge up the ranks to have C-level visibility? Someone needs to be the hero. :P

Continuing to circumvent the corporate controls puts your job and possibly your career in jeopardy. Likely you will impact your colleagues as well with even more onerous restrictions.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#34

Post by fugyk »

mayli wrote: post #3

I've been using iodine http://code.kryo.se/iodine/ for a long time.

I had used it once. But the speed it gave to me is too slow. I could not even open a basic site without waiting for 10-15 seconds. Had I done something wrong or is this speed same to you?

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#35

Post by yaleman »

fugyk wrote: post #34
mayli wrote: post #3

I've been using iodine http://code.kryo.se/iodine/ for a long time.

I had used it once. But the speed it gave to me is too slow. I could not even open a basic site without waiting for 10-15 seconds. Had I done something wrong or is this speed same to you?

It can be very slow because of the nature of the communication method. :(

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#36

Post by buserror »

chrismsnz wrote: post #26
JoshTriplett wrote: post #25

Earlier quoted context omitted.

> Circumventing your companies firewall is not a great idea in the first place. Neither is putting in place a firewall that makes people need to circumvent it to get their jobs done. If you work at the NSA, sure, it makes sense that all access is heavily restricted. (Though if you work at the NSA, please reconsider what you're doing with your life.) But if you work at an ordinary company, and doing your job (note: no…

I'm a security guy so I obviously have a differing viewpoint, but when it comes to ensuring what data comes in and leaves your environment there's little choice. The ability to analyse outgoing traffic is really a requirement for being able to effectively detect and respond to incidents. If your job involves idling on Freenode maybe take it up with management? EDIT: phrasing

It's still a bit silly, I can plug my smartphone in the same PC and have a completely un-monitored network link.. So instead of having /some/ sort of control on traffic if their firewall was not rendering the link useless for a lot of case, they get people (I see them) doing just that.

It's not security, it's security-by-the-checkbox, that doesn't prevent them having the whole intranet on a single shared drive, use outlook, flash, java etc etc. Oh, and such a braindead password policy (like, 6 of them) that everyone has to keep them on postits anyway.

Post reply on HN