- [Instructor] There are many different
attack methods for data exfiltration.
Now, one of the most popular
is to use DNS tunneling.
We're also seeing you know,
other type of tunneling
or other type of encapsulation,
things like even ICMP, NTP
actually being used to carry
sensitive information outside
of the corporate networks.
But DNS tunneling has been one
of the most commonly used nowadays.
We're seeing this use more
and more for malware based data exfiltration
out of enterprise networks.
Here I'm actually including
a Cisco Talos blog post on the link
which actually has a great example
of data exfiltration.
And also how to detect some of these data,
DNS data exfiltration techniques.
Now attackers can encapsulate chunks of data
into DNS packets to actually steal
sensitive information such as,
personal identifiable information,
credit card numbers, and a lot more, right?
So the sky is the limit.
Now, once you actually take those packets
or that, those informations
and divide them into chunks
you can put them in the payload
of those DNS packets
or like I mentioned before NTP or ICMP.
Any other type of packets that is expected
to actually be allowed to leave the organization.
Now, there are a few example
of DNS tunneling tools used by attackers
that I'm actually including a few here.
You know, things like DNS2TCP, DNScat, Iodine,
has a couple versions of it.
OzymanDNS, SplitBrain, TCP-Over-DNS,
as well as YourFreedom.
Again, these are for your reference,
there are many many other tools
and DNS tunneling techniques.
I'm actually including here another really
good reference from SANS that includes
additional types of tools
and DNS exfiltration attacks.
So, whenever you're preparing
for the exam, I will invite you
to actually go through these links
and at least become familiar
with these type of techniques
and type of methods of actually detecting
this type of tunneling.
DNS tunneling may be detected by analyzing
the DNS packet payload or by traffic analysis
like by count and also the frequency
of the DNS request in the network.