The very first exfiltration technique
that we're going to talk about is
called DNS Tunneling, and using DNS in order
to exfiltrate data.
Now, this is one that really blew my mind when I first
learned about it.
I was like, wow, that is such a creative way
to use DNS in order to steal sensitive information.
So by the end of this Nugget, we'll
understand how DNS can actually be used against us,
and what we should be really looking for on our DNS servers.
Let's get going.
So again, when I was learning about this particular WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So again, when I was learning about this particular
exfiltration technique, this is one that made me pause and go,
wow, that was really clever.
I would have probably never seen that happening
in my environment if I hadn't learned about it.
So what we have to do first of all,
is just basically set up the attack.
What does DNS even do in the first place,
and then how are they going to exploit the attack?
Then I'll actually show you what it's
going to look like in the real world when a DNS tunneling
exfiltration attack takes place.
So here we are on this particular computer here
this is our end user's computer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is our end user's computer.
Maybe it's Bob's computer one more time.
And Bob has, for whatever reason, been attacked,
he's been compromised.
Maybe he clicked on a phishing email,
he was social-engineered, he got a Trojan virus.
Whatever the case is, this computer is hosed.
And in order to perform the DNS exfiltration
technique, what we're using is DNS in order
to exfiltrate the data.
I mean, recall how DNS works for a second.
The idea is that we're going to send a DNS query to a DNS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The idea is that we're going to send a DNS query to a DNS
server.
And it's basically saying, what is the IP address
for a given website?
Something like google.com.
The payload is right here.
It's written in plain text.
So the DNS server receives the query for google.com,
and it replies with the IP address of google.com.
I don't know what it is off the top my head,
make something up like 20.20.20.20.
That's probably not google.com's IP address,
but pretend it is for a moment.
And that's the idea.
Is that the query here has been sent to the DNS server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Is that the query here has been sent to the DNS server,
and it replies with an IP address.
And if I pull up my little lab environment,
we can actually see it right here.
Let me hide the text.
See, I've got a little Windows computer down here,
and it's talking to a DNS server up here.
And if I look at my little Wireshark capture--
let me drag it over just for a second,
we'll click on one of these DNS queries--
right here in the payload we can see here's
the DNS response that's coming back.
And we see the query that was provided here, and then
the name adservice.google.com.
This is what the query was, and then the answer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is what the query was, and then the answer
is provided here, and these are the different IP addresses
that we can reach for adservice.google.com
The big thing to focus on here is
that this is the name of the DNS query that we're providing,
and it's written in text.
So when the attacker now has ownership over this computer,
what the attacker can do is change the DNS server
on the NIC itself to be the attackers-- actually,
let me change the color here, we'll use something like a bold
red-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
red--
to be the attacker's DNS server.
Put a big X over it, so we know it's bad.
And this DNS server might act just
like a man in the middle attack, where
it will forward the DNS queries, legitimate DNS queries,
to the DNS server so that everything appears
to be behaving as normal.
But under the hood, what this little malware application
can also be doing is it may be harvesting
sensitive information.
Things like usernames and passwords,
file share location, any GPOs that may be applied. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
file share location, any GPOs that may be applied.
And the crazy thing is, is it can also
exfiltrate that information using a DNS query.
Now, the kicker here is that DNS as a protocol itself
doesn't support every single character
that a computer can type.
So how it really works under the hood
is it may look something like this.
The first thing that will happen is
that the malware will actually encode
the data into a Base64 format.
This is one of the most basic forms of acceptable characters. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is one of the most basic forms of acceptable characters.
So it could say something like username knox,password cisco,
and then encode it into Base64.
So if I scroll down, this is what it's going to look like.
I'll copy that text, and I'll start the Wireshark capture
one more time.
So now what I'll try and do is I'll
do an NsLookup against that specific endpoint.
And let's see what took place behind the scenes
with Wireshark here.
Well, there's the query itself.
And guess what?
If the malicious DNS server is sitting here waiting on it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If the malicious DNS server is sitting here waiting on it,
all of this DNS data is being logged somewhere.
Maybe it's written to a log.
And now, the attacker can go and read those DNS logs
and find all of those queries that look like gobbledygook.
And then just decode them from Base64,
and now they've exfiltrated the username and password.
Do you see what I mean?
That's kind of a clever and incredibly smart
way that exfiltrate data using the DNS protocol.
You just encode the sensitive information
that you want to export, and just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that you want to export, and just
send a DNS query to the DNS server that's
already been compromised.
Or the DNS server that the hacker owns.
That way when the hackers ready, they
can sit down and go through all the logs.
And they find all of the URLs that look like gobbledygook
and then just decode them from Base64 and there it is.
There's the exfiltrated data.
And we-- the security administrator,
the security professional-- all we see is DNS traffic.
And that's pretty normal stuff for what
it comes to our normal usage of our network in our enterprise. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it comes to our normal usage of our network in our enterprise.
So we got to keep our eyes out for what
may be an indicator of compromise using DNS
as an exfiltration technique.
I hope this has been informative for you,
and I'd like to thank you for viewing.