WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:01.805 align:middle line:90%
The very first
exfiltration technique

3
00:01.805 --> 00:03.180 align:middle line:90%
that we're going
to talk about is

4
00:03.180 --> 00:06.630 align:middle line:90%
called DNS Tunneling,
and using DNS in order

5
00:06.630 --> 00:07.960 align:middle line:84%
to exfiltrate data.

6
00:07.960 --> 00:10.662 align:middle line:90%
Now, this is one that really
blew my mind when I first

7
00:10.662 --> 00:11.370 align:middle line:84%
learned about it.

8
00:11.370 --> 00:14.610 align:middle line:90%
I was like, wow, that
is such a creative way

9
00:14.610 --> 00:18.342 align:middle line:90%
to use DNS in order to
steal sensitive information.

10
00:18.342 --> 00:19.800 align:middle line:90%
So by the end of
this Nugget, we'll

11
00:19.800 --> 00:22.800 align:middle line:90%
understand how DNS can
actually be used against us,

12
00:22.800 --> 00:26.490 align:middle line:90%
and what we should be really
looking for on our DNS servers.

13
00:26.490 --> 00:27.640 align:middle line:84%
Let's get going.

14
00:27.640 --> 00:30.360 align:middle line:90%
So again, when I was learning
about this particular
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:27.640 --> 00:30.360 align:middle line:90%
So again, when I was learning
about this particular

15
00:30.360 --> 00:33.450 align:middle line:90%
exfiltration technique, this is
one that made me pause and go,

16
00:33.450 --> 00:35.482 align:middle line:84%
wow, that was really clever.

17
00:35.482 --> 00:37.440 align:middle line:90%
I would have probably
never seen that happening

18
00:37.440 --> 00:39.820 align:middle line:90%
in my environment if I
hadn't learned about it.

19
00:39.820 --> 00:41.560 align:middle line:90%
So what we have to
do first of all,

20
00:41.560 --> 00:43.530 align:middle line:90%
is just basically
set up the attack.

21
00:43.530 --> 00:45.600 align:middle line:90%
What does DNS even do
in the first place,

22
00:45.600 --> 00:48.300 align:middle line:90%
and then how are they going
to exploit the attack?

23
00:48.300 --> 00:50.190 align:middle line:90%
Then I'll actually
show you what it's

24
00:50.190 --> 00:53.640 align:middle line:90%
going to look like in the real
world when a DNS tunneling

25
00:53.640 --> 00:55.870 align:middle line:84%
exfiltration attack takes place.

26
00:55.870 --> 00:58.720 align:middle line:90%
So here we are on this
particular computer here

27
00:58.720 --> 01:00.390 align:middle line:84%
this is our end user's computer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.720 --> 01:00.390 align:middle line:84%
this is our end user's computer.

28
01:00.390 --> 01:02.670 align:middle line:90%
Maybe it's Bob's
computer one more time.

29
01:02.670 --> 01:05.640 align:middle line:90%
And Bob has, for whatever
reason, been attacked,

30
01:05.640 --> 01:06.870 align:middle line:84%
he's been compromised.

31
01:06.870 --> 01:08.800 align:middle line:90%
Maybe he clicked on
a phishing email,

32
01:08.800 --> 01:11.700 align:middle line:90%
he was social-engineered,
he got a Trojan virus.

33
01:11.700 --> 01:15.600 align:middle line:90%
Whatever the case is,
this computer is hosed.

34
01:15.600 --> 01:18.930 align:middle line:90%
And in order to perform
the DNS exfiltration

35
01:18.930 --> 01:22.320 align:middle line:90%
technique, what we're
using is DNS in order

36
01:22.320 --> 01:23.580 align:middle line:84%
to exfiltrate the data.

37
01:23.580 --> 01:26.130 align:middle line:90%
I mean, recall how DNS
works for a second.

38
01:26.130 --> 01:30.900 align:middle line:90%
The idea is that we're going
to send a DNS query to a DNS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:26.130 --> 01:30.900 align:middle line:90%
The idea is that we're going
to send a DNS query to a DNS

39
01:30.900 --> 01:31.500 align:middle line:84%
server.

40
01:31.500 --> 01:34.800 align:middle line:90%
And it's basically saying,
what is the IP address

41
01:34.800 --> 01:36.270 align:middle line:84%
for a given website?

42
01:36.270 --> 01:38.160 align:middle line:84%
Something like google.com.

43
01:38.160 --> 01:40.770 align:middle line:84%
The payload is right here.

44
01:40.770 --> 01:43.000 align:middle line:84%
It's written in plain text.

45
01:43.000 --> 01:46.318 align:middle line:90%
So the DNS server receives
the query for google.com,

46
01:46.318 --> 01:48.360 align:middle line:90%
and it replies with the
IP address of google.com.

47
01:48.360 --> 01:50.370 align:middle line:90%
I don't know what it
is off the top my head,

48
01:50.370 --> 01:52.950 align:middle line:90%
make something up
like 20.20.20.20.

49
01:52.950 --> 01:55.040 align:middle line:90%
That's probably not
google.com's IP address,

50
01:55.040 --> 01:56.920 align:middle line:84%
but pretend it is for a moment.

51
01:56.920 --> 01:57.900 align:middle line:84%
And that's the idea.

52
01:57.900 --> 02:00.780 align:middle line:90%
Is that the query here has
been sent to the DNS server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:57.900 --> 02:00.780 align:middle line:90%
Is that the query here has
been sent to the DNS server,

53
02:00.780 --> 02:02.800 align:middle line:90%
and it replies
with an IP address.

54
02:02.800 --> 02:04.810 align:middle line:90%
And if I pull up my
little lab environment,

55
02:04.810 --> 02:06.630 align:middle line:90%
we can actually
see it right here.

56
02:06.630 --> 02:08.530 align:middle line:84%
Let me hide the text.

57
02:08.530 --> 02:10.680 align:middle line:90%
See, I've got a little
Windows computer down here,

58
02:10.680 --> 02:12.790 align:middle line:90%
and it's talking to
a DNS server up here.

59
02:12.790 --> 02:14.850 align:middle line:90%
And if I look at my
little Wireshark capture--

60
02:14.850 --> 02:17.070 align:middle line:90%
let me drag it over
just for a second,

61
02:17.070 --> 02:18.960 align:middle line:90%
we'll click on one of
these DNS queries--

62
02:18.960 --> 02:21.330 align:middle line:90%
right here in the
payload we can see here's

63
02:21.330 --> 02:23.970 align:middle line:90%
the DNS response
that's coming back.

64
02:23.970 --> 02:26.790 align:middle line:90%
And we see the query that
was provided here, and then

65
02:26.790 --> 02:29.400 align:middle line:84%
the name adservice.google.com.

66
02:29.400 --> 02:31.920 align:middle line:90%
This is what the query
was, and then the answer
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.400 --> 02:31.920 align:middle line:90%
This is what the query
was, and then the answer

67
02:31.920 --> 02:34.770 align:middle line:90%
is provided here, and these
are the different IP addresses

68
02:34.770 --> 02:36.980 align:middle line:90%
that we can reach for
adservice.google.com

69
02:36.980 --> 02:39.030 align:middle line:90%
The big thing to
focus on here is

70
02:39.030 --> 02:42.660 align:middle line:90%
that this is the name of the
DNS query that we're providing,

71
02:42.660 --> 02:44.260 align:middle line:84%
and it's written in text.

72
02:44.260 --> 02:48.390 align:middle line:90%
So when the attacker now has
ownership over this computer,

73
02:48.390 --> 02:53.550 align:middle line:90%
what the attacker can do
is change the DNS server

74
02:53.550 --> 02:57.278 align:middle line:90%
on the NIC itself to be
the attackers-- actually,

75
02:57.278 --> 02:59.820 align:middle line:90%
let me change the color here,
we'll use something like a bold

76
02:59.820 --> 03:01.050 align:middle line:84%
red--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.820 --> 03:01.050 align:middle line:84%
red--

77
03:01.050 --> 03:04.320 align:middle line:84%
to be the attacker's DNS server.

78
03:04.320 --> 03:06.660 align:middle line:90%
Put a big X over it,
so we know it's bad.

79
03:06.660 --> 03:09.360 align:middle line:90%
And this DNS server
might act just

80
03:09.360 --> 03:11.190 align:middle line:90%
like a man in the
middle attack, where

81
03:11.190 --> 03:14.730 align:middle line:90%
it will forward the DNS
queries, legitimate DNS queries,

82
03:14.730 --> 03:17.610 align:middle line:90%
to the DNS server so
that everything appears

83
03:17.610 --> 03:19.440 align:middle line:84%
to be behaving as normal.

84
03:19.440 --> 03:22.830 align:middle line:90%
But under the hood, what this
little malware application

85
03:22.830 --> 03:25.410 align:middle line:90%
can also be doing is
it may be harvesting

86
03:25.410 --> 03:27.030 align:middle line:84%
sensitive information.

87
03:27.030 --> 03:29.820 align:middle line:90%
Things like usernames
and passwords,

88
03:29.820 --> 03:34.200 align:middle line:90%
file share location, any
GPOs that may be applied.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:29.820 --> 03:34.200 align:middle line:90%
file share location, any
GPOs that may be applied.

89
03:34.200 --> 03:37.080 align:middle line:90%
And the crazy thing
is, is it can also

90
03:37.080 --> 03:41.400 align:middle line:90%
exfiltrate that information
using a DNS query.

91
03:41.400 --> 03:44.910 align:middle line:90%
Now, the kicker here is that
DNS as a protocol itself

92
03:44.910 --> 03:47.280 align:middle line:90%
doesn't support every
single character

93
03:47.280 --> 03:48.600 align:middle line:84%
that a computer can type.

94
03:48.600 --> 03:50.730 align:middle line:90%
So how it really
works under the hood

95
03:50.730 --> 03:52.720 align:middle line:90%
is it may look
something like this.

96
03:52.720 --> 03:54.570 align:middle line:90%
The first thing
that will happen is

97
03:54.570 --> 03:56.790 align:middle line:90%
that the malware
will actually encode

98
03:56.790 --> 03:59.520 align:middle line:84%
the data into a Base64 format.

99
03:59.520 --> 04:02.710 align:middle line:90%
This is one of the most basic
forms of acceptable characters.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:59.520 --> 04:02.710 align:middle line:90%
This is one of the most basic
forms of acceptable characters.

100
04:02.710 --> 04:08.250 align:middle line:90%
So it could say something like
username knox,password cisco,

101
04:08.250 --> 04:10.740 align:middle line:84%
and then encode it into Base64.

102
04:10.740 --> 04:13.710 align:middle line:90%
So if I scroll down, this is
what it's going to look like.

103
04:13.710 --> 04:16.860 align:middle line:90%
I'll copy that text, and I'll
start the Wireshark capture

104
04:16.860 --> 04:17.592 align:middle line:84%
one more time.

105
04:17.592 --> 04:19.050 align:middle line:90%
So now what I'll
try and do is I'll

106
04:19.050 --> 04:21.982 align:middle line:90%
do an NsLookup against
that specific endpoint.

107
04:21.982 --> 04:23.940 align:middle line:90%
And let's see what took
place behind the scenes

108
04:23.940 --> 04:25.110 align:middle line:84%
with Wireshark here.

109
04:25.110 --> 04:27.120 align:middle line:84%
Well, there's the query itself.

110
04:27.120 --> 04:28.140 align:middle line:84%
And guess what?

111
04:28.140 --> 04:31.680 align:middle line:90%
If the malicious DNS server
is sitting here waiting on it,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:28.140 --> 04:31.680 align:middle line:90%
If the malicious DNS server
is sitting here waiting on it,

112
04:31.680 --> 04:34.980 align:middle line:90%
all of this DNS data is
being logged somewhere.

113
04:34.980 --> 04:36.540 align:middle line:84%
Maybe it's written to a log.

114
04:36.540 --> 04:40.380 align:middle line:90%
And now, the attacker can
go and read those DNS logs

115
04:40.380 --> 04:43.980 align:middle line:90%
and find all of those queries
that look like gobbledygook.

116
04:43.980 --> 04:46.920 align:middle line:90%
And then just decode
them from Base64,

117
04:46.920 --> 04:49.712 align:middle line:90%
and now they've exfiltrated
the username and password.

118
04:49.712 --> 04:50.670 align:middle line:84%
Do you see what I mean?

119
04:50.670 --> 04:53.100 align:middle line:90%
That's kind of a clever
and incredibly smart

120
04:53.100 --> 04:56.430 align:middle line:90%
way that exfiltrate data
using the DNS protocol.

121
04:56.430 --> 04:59.490 align:middle line:90%
You just encode the
sensitive information

122
04:59.490 --> 05:01.320 align:middle line:90%
that you want to
export, and just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:59.490 --> 05:01.320 align:middle line:90%
that you want to
export, and just

123
05:01.320 --> 05:05.610 align:middle line:90%
send a DNS query to
the DNS server that's

124
05:05.610 --> 05:06.720 align:middle line:84%
already been compromised.

125
05:06.720 --> 05:09.108 align:middle line:90%
Or the DNS server
that the hacker owns.

126
05:09.108 --> 05:10.650 align:middle line:90%
That way when the
hackers ready, they

127
05:10.650 --> 05:12.570 align:middle line:90%
can sit down and go
through all the logs.

128
05:12.570 --> 05:15.690 align:middle line:90%
And they find all of the URLs
that look like gobbledygook

129
05:15.690 --> 05:19.060 align:middle line:90%
and then just decode them
from Base64 and there it is.

130
05:19.060 --> 05:20.640 align:middle line:84%
There's the exfiltrated data.

131
05:20.640 --> 05:23.340 align:middle line:90%
And we-- the security
administrator,

132
05:23.340 --> 05:26.670 align:middle line:90%
the security professional--
all we see is DNS traffic.

133
05:26.670 --> 05:28.590 align:middle line:90%
And that's pretty
normal stuff for what

134
05:28.590 --> 05:32.380 align:middle line:90%
it comes to our normal usage of
our network in our enterprise.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:28.590 --> 05:32.380 align:middle line:90%
it comes to our normal usage of
our network in our enterprise.

135
05:32.380 --> 05:34.410 align:middle line:90%
So we got to keep
our eyes out for what

136
05:34.410 --> 05:37.290 align:middle line:90%
may be an indicator of
compromise using DNS

137
05:37.290 --> 05:38.852 align:middle line:84%
as an exfiltration technique.

138
05:38.852 --> 05:40.560 align:middle line:90%
I hope this has been
informative for you,

139
05:40.560 --> 05:43.250 align:middle line:90%
and I'd like to thank
you for viewing.