Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

DNS Tunneling: how DNS can be (ab)used by malicious actors

Summary: Unit 42 describes how malicious actors use DNS, which runs on nearly always-open Port 53 over UDP, as a command-and-control channel, for data exfiltration, and for delivering payloads to victim systems. The report details beaconing via crafted query strings that carry base64-encoded host metadata, TXT record responses that can return encoded binary executables, and NOERROR IP responses that can encode commands among 4,294,967,296 possible values.

What's compelling: A few dozen extra UDP DNS queries from your network would be fairly inconspicuous, and freely available GitHub tools make covert DNS channels easy to stand up, so the protocol most organizations leave unexamined is the one carrying an adversary's commands.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related