[VulnDiscuss] Re: Abusing DNS protocol

At 09:22 -0300 on 2003-05-29, OTERO Hernan Gustavo EDS wrote:
> As security consultant I have seen several times a DNS architecture where
> the DNS of the organization makes the internal consultations and the
> external consultations.


Some use that technique for connectivity to home through recursive DNS
servers from remote, restricted nets.

Simple telnet or ssh proxies are one way, in use since at least 1994 at one
lab I know of.

IP tunnels are more generally useful.  The best-known example is
linux-specific:  <http://nstx.dereference.de/nstx/>

I have heard of others, more sophisticated, that route IPSEC traffic
through DNS recursion.  I don't have pointers to their source.  However, I
wouldn't mind such pointers, or at least names.

Countermeasures, such as restricting the number of queries allowed from
unauthenticated users on your wireless networks, can effectively stop
interactive use.  However, such won't necessarily stop a worm that only
needs a few bytes for a covert channel.


Richard