What is DNS Tunneling?

The Domain Name System (DNS) is one of the most important technologies used on the Internet and in networking in general. This is the system that translates IP addresses into human-friendly domain names, also called Uniform Resource Locators (URLs), so that people can access websites more easily. DNS is necessary because humans are much better at being able to remember something than they are at memorizing an IP address – especially since IPv6 addresses are 128 bits long! Because DNS has been an essential technology for years, it has also been looked at closely by hackers trying to find attack vulnerabilities. One of the most damaging types of DNS attacks is known as DNS tunneling.

What is DNS Tunneling?

DNS tunneling is a technique used to bypass network restrictions and involves encapsulating unauthorized or non-standard data within DNS queries and responses. While it can be used for legitimate purposes, it can also be used by attackers to route DNS requests to their servers, which gives the attackers a control channel, a cover command, and a data exfiltration path.

Since DNS traffic is often allowed through firewalls and other security measures, attackers can exploit this protocol to hide their malicious activities. With DNS tunneling, attackers can take control of remote servers and apps, exfiltrate data, and bypass network restrictions, which makes it a dangerous attack.

How does it work?

DNS is one of the fundamental protocols of the Internet. Without the lookup services that it provides, it would be nearly impossible to find anything on the Internet. To visit a website, you would need to know the exact IP address of the server that is hosting it, which is impossible. As a result, DNS traffic is some of the most trusted traffic on the Internet. Organizations allow it to pass through their firewall (both inbound and outbound) because it is necessary for their internal employees to visit external sites and for external users to find their websites.

DNS tunneling takes advantage of this fact by using DNS requests to implement a command and control channel for malware. Inbound DNS traffic can carry commands to the malware, while outbound traffic can exfiltrate sensitive data or provide responses to the malware operator’s requests. This works because DNS is a very flexible protocol. There are very few restrictions on the data that a DNS request contains because it is designed to look for domain names of websites. Since almost anything can be a domain name, these fields can be used to carry sensitive information. These requests are designed to go to attacker-controlled DNS servers, ensuring that they can receive the requests and respond in the corresponding DNS replies.

DNS tunneling attacks are simple to perform, and numerous DNS tunneling toolkits exist. This makes it possible for even unsophisticated attackers to use this technique to sneak data past an organization’s network security solutions.

How do hackers use DNS tunneling?

DNS tunneling enables attackers to perform a variety of malicious activities.

• Installing malware. Attackers may use DNS tunneling to install malware on additional systems.
• Collecting credentials. Once they have command and control of a device, attackers can use keyloggers and other methods to collect user credentials that can be used to mount additional attacks or be sold on the dark web.
• Exploring the network. DNS queries from within an infected network can help attackers build a map of the network, identifying systems and high-value assets.
• Exfiltrating data. Cybercriminals may use DNS tunneling to transfer data out of the network, including sensitive or confidential user information.
• Controlling devices. With the ability to control an infected device, attackers can trigger other threats such as DDoS attacks.

What are the risks of DNS Tunneling?

The primary risk of DNS tunneling is that it can be used to bypass network security measures. Since DNS is a necessary protocol for the functioning of the internet, most networks allow DNS traffic to pass through without inspection. This makes DNS an ideal channel for cybercriminals to data exfiltration, network infiltration, or control of DNS tunneling malware.

DNS tunneling can also be used to carry out attacks, where a large amount of DNS traffic is used to overwhelm a network and cause a denial of service.

Furthermore, DNS tunneling can be used to hide the presence of DNS-based malware on a network, making it harder to detect and remove.

How can DNS tunneling be detected?

Security teams can analyze payloads and traffic for signs of a DNS tunneling attack.

Payload analysis looks at the contents of DNS requests and responses. For example, unusual hostnames, or significant differences between the size of a DNS request and the response, may be a sign of suspicious activity. Payload analysis may also search for unusual character sets, strange information being sent via DNS, DNS record types that are not frequently used, or recurring patterns from source IP addresses sending the most traffic.

Traffic analysis monitors data like the number of requests made, where they originate, the history of domains, and DNS anomalous behavior. IT teams may also analyze the size of packets since DNS tunneling typically generates larger packet sizes.

How to keep safe from DNS Tunneling attacks

Most companies consider the DNS protocol to be safe and trustworthy by default. This is why few of them use traffic analysis to check DNS packets for malicious data. Instead, they rather focus all resources on email traffic, for example.

However, ignoring DNS security best practices brings serious risks to your infrastructure. For obvious reasons, you can’t just block a vital service, like DNS. So, here’s what you can do to protect against DNS tunneling attacks.

• Make sure that all your internal customers have their DNS queries routed to an internal DNS server, so you can reject any malicious domains.
• Use DNS logging to swiftly identify and counter potential DNS attacks.
• Create a DNS firewall to detect and prevent hackers’ intrusions.
• Use a real-time DNS security solution to identify odd DNS requests and network traffic patterns.

Conclusion

DNS tunneling is a process where an attacker encodes data in DNS queries and responses to communicate between a compromised system and a remote server. Using DNS tunneling attackers can establish a communication route between a hacked system and a remote server they control. DNS Tunneling enables them to steal data, run commands, and keep permanent control over infected systems.