Misuse of DNS, the Second Most Used Protocol
summary
Claims a practical DNS exfiltration framework called dnsfiltration that splits control and data domains, spoofs many internal source IPs and uses NS queries to blend traffic. Demo sends a 4 48‑chunk file over 5 data domains with ~254 spoofed IPs, compresses and encrypts chunks with AES-256-CTR, supports retransmission and parallel threads, and verifies integrity with CRC/MD5 — file arrives intact. Discusses detection limits and mitigations: block external DNS, proxying, sinkholes and entropy/log analytics.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:22Hello, Virtual Friend
- 0:32Attacks on DNS
- 1:50Security on DNS
- 3:15Estimated DNS Usage
- 3:33Cover Channels
- 9:03Control & Data
- 10:24Stealth
- 11:48Can we do all that??
- 11:58Proof of Life
- 17:57Prevention & Detection
- 21:43Conclusion
related talks
43mBlock DNS exfiltration with dnsmasq proxy
25mDark Side of the DNS Force
47mDNS On Fire
34mPractical Steps for Reducing Exposure and Detecting Compromise
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
41mWhen Cybersecurity Is More Than Just Vulnerabilities
31mNew Techniques for Split-Second DNS Rebinding
32mDNS as Added Security Against Ransomware Attacks