Block DNS exfiltration with dnsmasq proxy
summary
Shows DNS used to steal secrets by turning environment variables into DNS names and by creating a two‑way tunnel (demoed with a dnscat‑style session after a Log4Shell exploit), argues network detection is often too slow or expensive, and builds a per‑namespace dnsmasq sidecar that enforces a short per-namespace allowlist of zones. Implementation is open source, integrates with Radix to inject the proxy into each namespace, and the demos show the proxy reliably refuses exfiltration queries.
AI-written summary · about
chapters (10)
- 0:00Introduction to speaker
- 1:05Understanding DNS
- 4:17DNS exfiltration and tunneling
- 6:57History of DNS hacking
- 14:46Log4Shell demo
- 21:43Command injection demo
- 24:32Prevention strategies
- 30:31Radix platform solution
- 34:09Demonstrating the solution
- 36:43Q&A and conclusion
related talks
26mMisuse of DNS, the Second Most Used Protocol
47mDNS On Fire
34mPractical Steps for Reducing Exposure and Detecting Compromise
34mUsing DNS as a layer of defense
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
01h 27mDNS at 30
58mMultivariate Solutions To Emerging Passive DNS Challenges