{"id":29554,"date":"2023-05-06T05:01:44","date_gmt":"2023-05-06T03:01:44","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=29554"},"modified":"2023-05-12T06:34:43","modified_gmt":"2023-05-12T04:34:43","slug":"dnsteal-data-exfiltration-and-tunneling-via-dns-techniques-and-detection","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2023\/05\/06\/dnsteal-data-exfiltration-and-tunneling-via-dns-techniques-and-detection\/","title":{"rendered":"DNSteal: Data Exfiltration and Tunneling via DNS – Techniques and Detection"},"content":{"rendered":"

\"Sicherheit[German<\/a>]A security topic that was not really on my radar: data theft through manipulation of the Domain Name System (DNS). The whole thing goes under the terms DNSteal and DNS Exfiltration. Roughly speaking, these are techniques that can be used to tunnel firewalls and exfiltrate (steal) data via redirected DSN servers.<\/p>\n

<\/p>\n

Data Exfiltration through DNS Exfiltration<\/h2>\n

\"\"Especially for enterprises, there is a risk of data being siphoned off from the corporate network without being noticed. IT does try to block a data outflow through firewalls and other security measures. But hackers are looking for ways to abuse the DNS (Domain Name System) for their own purposes.<\/p>\n

Advice from Akamai<\/h3>\n

Security vendor Akamai has am article\u00a0DNS: The Easiest Way to Exfiltrate Data?<\/a> on the topic, which describes the various ways attackers abuse DNS. These include DNS tunneling (high throughput) and DNS exfiltration (low throughput).<\/p>\n

Attackers take advantage of 'the fact that most companies do not interfere with DNS traffic due to its critical role, according to Akamai. Therefore, in the two variants mentioned above, the DNS protocol is used to exfiltrate data. In each case, the attackers add data to DNS requests that has nothing to do with the request.<\/p>\n