Tunneling Data and Commands Over DNS to Bypass Firewalls

by tedyoung • 11 years ago

70 34 11 years ago

dvt3• 11 years ago

Don't tell anyone, but I did this on a plane ;) It was fickle, but I imagine you could build an entire protocol on top of DNS.

gruez• 11 years ago

wait, you could bypass the inflight wifi's paywall by using dns tunneling?

gwillen• 11 years ago

You can bypass essentially all paywalls using DNS tunnelling. The connection you get has _terrible_ bandwidth and latency characteristics, which is why nobody does it.

dvt3• 11 years ago

Yep!

samdroid• 11 years ago

The adobe air based VPNoverDNS app [1] works pretty well. You can set up port forwarding for irc and SSH.

Iodine seems to be a bit more complex as the default configuration doesn't work in that environment.

[1] https://play.google.com/store/apps/details?id=air.com.mail4h...

mayli• 11 years ago

I've been using iodine http://code.kryo.se/iodine/ for a long time.

buserror3• 11 years ago

Ah, I need to start using this. Work's firewall is completely bonkers, and they just removed access to webchat.freenode.net, so I need to find a way to punch thru... You can't even ssh out, or use websockets etc...

chrismsnz4• 11 years ago

Circumventing your companies firewall is not a great idea in the first place.

Additionally, if they have aggressive egress filtering, its likely that the only DNS communication will be via an internal resolver which is going to be monitored - iodine is going to leave a LOT of shit in those logs.

xenophonf• 11 years ago

Why not just use your smartphone or something instead? As an infosec guy, I try to maintain the customer service-oriented attitude of "Oh, you snuck something past me? Nice one! Don't do it again. Here's why..." Then again, I am fortunate enough to work in a semi-open academic/clinical/research environment, where if you cross-your-heart-and-hope-to-die promise me that you won't misuse BitTorrent for warez or porn and that you truly have a business need for it, I'll entertain your request for a firewall/QoS exception. But if you work at the kind of place that is manned by totally bonkers jackbooted thugs, they won't be so lenient. When they find you, you could lose your job or worse. It sucks, but the network's not yours to hack around even if you really do know better than the people operating it (and you probably do).

(signed, a former firewall piercer extraordinaire)

((I got so fed up with one customer's stupid firewall rules that I bought a dial-up subscription to Earthlink and an adapter that would let me hook my modem up to the handset of their digital phone.))

(((Holy shit! Earthlink still has dialup service!)))

socceroos• 11 years ago

Anything using an MD5 hash cannot be considered secure.

Edit: From the site's blurb on Security: "iodine uses challenge-response login secured by MD5 hash." Sorry, but MD5 as 'secure' died a long time ago.

fugyk• 11 years ago

I had used it once. But the speed it gave to me is too slow. I could not even open a basic site without waiting for 10-15 seconds. Had I done something wrong or is this speed same to you?

yaleman• 11 years ago

It can be very slow because of the nature of the communication method. :(

jkot• 11 years ago

One mobile operator in central europe allows ICMP on all phones...

slirpee• 11 years ago

I was tinkering with DNS tunneling for free mobile internet, and found that TCP port 53 was apparently unfettered. (Other traffic I tried was firewalled, and HTTP was captured and redirected to a page prompting to buy a data plan.) I guess the intention was for DNS over TCP, but I was able to ssh over that port and got decent speeds and no apparent tampering of the traffic.

jbuzbee2• 11 years ago

From reading the article, it looks like in the most restrictive environment, the "malware" (dnscat2) behind the firewall passes data out by resolving lots and lots of unique subhosts at the controlled DNS server, e.g. many queries of hosts like: 19c301abcddeadbeef.malware.com.

It seems like this pattern could be recognized behind the firewall. How often would a real Internet client resolve hundreds or thousands of sub-hosts in a short timeframe?

TheLoneWolfling2• 11 years ago

Relatively often, actually.

For instance, on this link on HN: https://medium.com/@bchesky/7-rejections-7d894cbaa084

It loads <some random subdomain>.cloudfront.net - and it changes every reload for me. For instance, d262ilb51hltx0.cloudfront.net, dnqgz544uhbo8.cloudfront.net, d262ilb51hltx0.cloudfront.net.

jbuzbee2• 11 years ago

That seems a bit different. A unique subdomain for each web page load might be common, but from my reading of the article, it looks like every packet of the tunneled conversation gets a unique domain. So for transferring any amount of data, I'd expect to see hundreds (thousands?) of subdomain resolution queries in a few minutes. That could raise a red flag.

I suppose if the malware wanted to be more stealthy, it could slow transfers way down, intermix unrelated queries and spread the tunnel across multiple unrelated controlled domains.

Tunneling Data and Commands Over DNS to Bypass Firewalls

Related Stories