Unit 8: Scans, beacons and leaks · Lesson 2 of 6 · 20 min

Data leaving through DNS

Recognise DNS tunnelling by the shape of the names and find the laptop behind it.

mission

You are
The analyst following up a DNS alert.
Situation
dns.pcap holds an hour of lookups from the office. Earlier you saw 40 failed answers and some very long names.
Goal
Work out whether data is leaving through DNS, from which laptop and to which domain.
Hand in
The laptop, the receiving domain and the number of queries.

Data smuggled through DNS

01

List questions by client

Print who asked for what. Normal names repeat; tunnelled names never do.

analyst@net-lab
tshark -r dns.pcap -Y 'dns.flags.response==0' -T fields -e ip.src -e dns.qry.name | head -n 3
10.10.0.31	www.example.com
10.10.0.23	db01.corp.example
10.10.0.23	www.example.com

Longest names first

Click a stage to see what flows out of it
www.example.com
db01.corp.example
www.example.com
www.corp.example
db01.corp.example
www.corp.example
mail01.corp.example
intranet.corp.example
intranet.corp.example
intranet.corp.example
intranet.corp.example
8a8e9bb8bdb5eba456bf92d5d98065e5751f75143a5f61de.00.t.cdn-sync.example.net
intranet.corp.example
267b0bc8d3b1939a9b4ddbe45cf642b0c3a4acdd7f9fcc58.01.t.cdn-sync.example.net

14 lines. query names, before any filter

The first 14 query names. Length alone separates tunnelled data from real lookups.
02

Rank by the domain they end in

Keep the last three labels of each name, then count. Tunnelled names collapse into one domain.

analyst@net-lab
tshark -r dns.pcap -Y 'dns.flags.response==0' -T fields -e dns.qry.name | awk -F. '{print $(NF-2)"."$(NF-1)"."$NF}' | sort | uniq -c | sort -rn | head -n 3
     40 cdn-sync.example.net
     15 intranet.corp.example
     11 mail01.corp.example

you should see 40 queries went to one domain nobody uses for work, far more than any real service.

03

Find the sender

Check who asked for that domain.

analyst@net-lab
tshark -r dns.pcap -Y 'dns.qry.name contains "cdn-sync" && dns.flags.response==0' -T fields -e ip.src | sort | uniq -c
     40 10.10.0.57

you should see All 40 from laptop-rpatel.

defender tip Alert on clients that send many long, unique names to one domain. Volume of unique subdomains per domain is a better signal than any single name.

Normal and tunnelled lookups

Tunnelled
8a8e9bb8bdb5...61de.00.t.cdn-sync.example.net
267b0bc8d3b1...cc58.01.t.cdn-sync.example.net

Long, random, numbered, never repeated, all NXDOMAIN.

Normal
intranet.corp.example
mail01.corp.example

Short, readable, repeated, answered.

04

Measure the name lengths

Real host names are short. Names that all have the same long length are usually encoded data.

analyst@net-lab
tshark -r dns.pcap -Y 'dns.qry.name contains "cdn-sync" && dns.flags.response==0' -T fields -e dns.qry.name | awk '{print length($1)}' | sort -n | uniq -c | head -n 3
     40 74

you should see All 40 names are exactly 74 characters long.

defender tip Alert on long names and on many unique subdomains under one parent domain.

What a defender takes away

  1. 1DNS can carry data out when everything else is blocked.
  2. 2Length, randomness and one receiving domain give tunnelling away.
  3. 3Block the domain at the resolver, isolate the laptop, then investigate it.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    Sort query names by length, then check who asked for them.

  2. Show hint

    Keep the last three labels of every name and rank them.

  3. Show hint

    Count questions whose name contains it.