bugtraq - [VulnDiscuss] Re: Abusing DNS protocol

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 29 May 2003 17:45:26 -0600
From: "Richard Johnson" <rdump@...er.com>
To: OTERO Hernan Gustavo EDS <bazhgo@...hint.net>
Cc: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: [VulnDiscuss] Re: Abusing  DNS protocol

At 09:22 -0300 on 2003-05-29, OTERO Hernan Gustavo EDS wrote:
> As security consultant I have seen several times a DNS architecture where
> the DNS of the organization makes the internal consultations and the
> external consultations.

Some use that technique for connectivity to home through recursive DNS
servers from remote, restricted nets.

Simple telnet or ssh proxies are one way, in use since at least 1994 at one
lab I know of.

IP tunnels are more generally useful.  The best-known example is
linux-specific:  <http://nstx.dereference.de/nstx/>

I have heard of others, more sophisticated, that route IPSEC traffic
through DNS recursion.  I don't have pointers to their source.  However, I
wouldn't mind such pointers, or at least names.

Countermeasures, such as restricting the number of queries allowed from
unauthenticated users on your wireless networks, can effectively stop
interactive use.  However, such won't necessarily stop a worm that only
needs a few bytes for a covert channel.

Richard