Exfiltration Over DNS
MITRE ATT&CK™ - Exfiltration Over Alternative Protocol - Technique T1048
Last updated
Was this helpful?
MITRE ATT&CK™ - Exfiltration Over Alternative Protocol - Technique T1048
Last updated
Was this helpful?
The DNS protocol is a common protocol and Its primary purpose is to resolve domain names to IP addresses and vice versa. Even though the DNS protocol is not designed to transfer data, threat actors found a way to abuse and move data over it. Since DNS is not a transport protocol, many organizations don't regularly monitor the DNS protocol! The DNS protocol is allowed in almost all firewalls in any organization network. For those reasons, threat actors prefer using the DNS protocol to hide their communications.
The DNS protocol has limitations that need to be taken into consideration, which are as follows,
The maximum length of the Fully Qualified FQDN domain name (including .separators) is 255 characters.
The subdomain name (label) length must not exceed 63 characters (not including .com, .net, etc).
Now let's discuss the Data Exfiltration over DNS requirements and steps, which are as follows: 1 - An attacker registers a domain name, for example, tunnel.com 2 - The attacker sets up tunnel.com's NS record points to a server that the attacker controls. 3 - The malware or the attacker sends sensitive data from a victim machine to a domain name they control—for example, passw0rd.tunnel.com, where passw0rd is the data that needs to be transferred. 4 - The DNS request is sent through the local DNS server and is forwarded through the Internet. 5 - The attacker's authoritative DNS (malicious server) receives the DNS request. 6 - Finally, the attacker extracts the password from the domain name.
In order to receive any DNS request on the attacking machine, we need to capture the network traffic for any incoming UDP/53 packets using the tool.
On the victim machine, we first encode datas that need to be send, and split it into one or multiple DNS requests depending on the output's length (DNS limitations) and attach it as a subdomain name.
In order to send this datas, on the compromised host we can do:
Finally, on the attacking machine, we can decrypt datas as follow:
An other methode is to tunneling other protocols over DNS. Check this page for more details.
allows for transfering (exfiltrate) a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel. On the attacking machine we do:
