Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tunneling Data and Commands Over DNS to Bypass Firewalls

zeltser.com

Post reply on HN
Print view View original

21–30 of 36 posts

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#21

Post by buserror »

chrismsnz wrote: post #17
buserror wrote: post #15

Earlier quoted context omitted.

Ah, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...

Circumventing your companies firewall is not a great idea in the first place. Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

Well I hope they don't proxy the DNS -- it's quite costly to do so, if they don't it'll be fine. If they do, well, I'll have to find another way using 'long' http transactions and such...

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#22

Post by chrismsnz »

buserror wrote: post #21
chrismsnz wrote: post #17

Earlier quoted context omitted.

Circumventing your companies firewall is not a great idea in the first place. Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

Well I hope they don't proxy the DNS -- it's quite costly to do so, if they don't it'll be fine. If they do, well, I'll have to find another way using 'long' http transactions and such...

Running an internal DNS resolver is actually very cheap, almost every broadband CPE device runs or can run its own DNS proxy resolver.

It's also a great source of information when monitoring egress communication, so I would just make sure you know what you're doing.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#23

Post by hueving »

buserror wrote: post #21
chrismsnz wrote: post #17

Earlier quoted context omitted.

Circumventing your companies firewall is not a great idea in the first place. Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

Well I hope they don't proxy the DNS -- it's quite costly to do so, if they don't it'll be fine. If they do, well, I'll have to find another way using 'long' http transactions and such...

Why would you think that's costly? A cheap home router can do it with dnsmasq.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#24

Post by slirpee »

jkot wrote: post #12

One mobile operator in central europe allows ICMP on all phones...

I was tinkering with DNS tunneling for free mobile internet, and found that TCP port 53 was apparently unfettered. (Other traffic I tried was firewalled, and HTTP was captured and redirected to a page prompting to buy a data plan.) I guess the intention was for DNS over TCP, but I was able to ssh over that port and got decent speeds and no apparent tampering of the traffic.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#25

Post by JoshTriplett »

chrismsnz wrote: post #17
buserror wrote: post #15

Earlier quoted context omitted.

Ah, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...

Circumventing your companies firewall is not a great idea in the first place. Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

> Circumventing your companies firewall is not a great idea in the first place.

Neither is putting in place a firewall that makes people need to circumvent it to get their jobs done. If you work at the NSA, sure, it makes sense that all access is heavily restricted. (Though if you work at the NSA, please reconsider what you're doing with your life.) But if you work at an ordinary company, and doing your job (note: not goofing off, but actually doing your job) requires you to work around the corporate firewall, that's a serious policy problem. And the answer isn't to sit on your hands until IT fixes the firewall, because IT departments invariably seem to have far too many people in them that forget that you can't create security by preventing work. A system encased in concrete is secure, but not useful.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#26

Post by chrismsnz »

JoshTriplett wrote: post #25
chrismsnz wrote: post #17

Earlier quoted context omitted.

Circumventing your companies firewall is not a great idea in the first place. Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

> Circumventing your companies firewall is not a great idea in the first place. Neither is putting in place a firewall that makes people need to circumvent it to get their jobs done. If you work at the NSA, sure, it makes sense that all access is heavily restricted. (Though if you work at the NSA, please reconsider what you're doing with your life.) But if you work at an ordinary company, and doing your job (note: no…

I'm a security guy so I obviously have a differing viewpoint, but when it comes to ensuring what data comes in and leaves your environment there's little choice. The ability to analyse outgoing traffic is really a requirement for being able to effectively detect and respond to incidents.

If your job involves idling on Freenode maybe take it up with management?

EDIT: phrasing

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#27

Post by xenophonf »

buserror wrote: post #15
mayli wrote: post #3

I've been using iodine http://code.kryo.se/iodine/ for a long time.

Ah, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...

Why not just use your smartphone or something instead? As an infosec guy, I try to maintain the customer service-oriented attitude of "Oh, you snuck something past me? Nice one! Don't do it again. Here's why..." Then again, I am fortunate enough to work in a semi-open academic/clinical/research environment, where if you cross-your-heart-and-hope-to-die promise me that you won't misuse BitTorrent for warez or porn and that you truly have a business need for it, I'll entertain your request for a firewall/QoS exception. But if you work at the kind of place that is manned by totally bonkers jackbooted thugs, they won't be so lenient. When they find you, you could lose your job or worse. It sucks, but the network's not yours to hack around even if you really do know better than the people operating it (and you probably do).

(signed, a former firewall piercer extraordinaire)

((I got so fed up with one customer's stupid firewall rules that I bought a dial-up subscription to Earthlink and an adapter that would let me hook my modem up to the handset of their digital phone.))

(((Holy shit! Earthlink still has dialup service!)))

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#28

Post by cfallin »

huhtenberg wrote: post #6
gwillen wrote: post #5

Earlier quoted context omitted.

You can bypass essentially all paywalls using DNS tunnelling. The connection you get has _terrible_ bandwidth and latency characteristics, which is why nobody does it.

Not entirely correct. This doesn't work for many hotel paywalls, because they would have a catch-all rule for all DNS A queries (resolving to a local IP of authenticating proxy) and block everything else. And the reason is exactly because of the DNS tunneling, which was making rounds in p2p circles as far back as 2005 if not earlier.

Doesn't this cause issues with cached bogus A records once the user pays and is granted access? I suppose you could return really short TTLs, but there would still be a delay of at least a few seconds.

(I'm not doubting they do this, just saying it seems very hacky...)

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#29

Post by detaro »

cfallin wrote: post #28
huhtenberg wrote: post #6

Earlier quoted context omitted.

Not entirely correct. This doesn't work for many hotel paywalls, because they would have a catch-all rule for all DNS A queries (resolving to a local IP of authenticating proxy) and block everything else. And the reason is exactly because of the DNS tunneling, which was making rounds in p2p circles as far back as 2005 if not earlier.

Doesn't this cause issues with cached bogus A records once the user pays and is granted access? I suppose you could return really short TTLs, but there would still be a delay of at least a few seconds. (I'm not doubting they do this, just saying it seems very hacky...)

Yes, it does, and of course fails if the site called is https. AFAIK some implementations work as a proxy after successful authentication to reduce that problem.

Other solutions use proxy configuration detection to redirect people to a proxy that first asks for authentication/payment. (wpad file)

Both solutions are kind of hacky, but they work for more or less all devices.

Re: Tunneling Data and Commands Over DNS to Bypass Firewalls

#30

Post by socceroos »

mayli wrote: post #3

I've been using iodine http://code.kryo.se/iodine/ for a long time.

Anything using an MD5 hash cannot be considered secure.

Edit: From the site's blurb on Security: "iodine uses challenge-response login secured by MD5 hash." Sorry, but MD5 as 'secure' died a long time ago.

Post reply on HN