Hackers Abuse DNS Tunneling For Covert Communication & Firewall Bypass

As a sneaky scheme, hackers use DNS tunneling to bypass traditional security measures.

By wrapping malicious data inside DNS queries and responses, they can smuggle out sensitive information or talk to command and control servers without getting caught.

DNS tunneling provides an avenue for hackers to employ DNS protocols as covert channels of data exfiltration where the traffic appears legitimate on the face but it is not.

Besides this, it incorporates encryption capabilities that make it difficult for security systems to carry out thorough investigations into whether malicious traffic exists.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Cybersecurity researchers at Palo Alto Networks recently discovered that hackers have been actively leveraging the “DNS Tunneling” for tracking and scanning.

Hackers Abuse DNS Tunneling

While DNS tunneling is commonly used for covert C2 communications, cybersecurity analysts recently detected campaigns employing it for network scanning and tracking email delivery or CDN usage.

For scanning, threat actors tunnel DNS queries to map a victim’s infrastructure. For tracking, they monitor DNS interactions related to malicious emails and CDNs.

Embedding data in DNS requests and responses allows compromised hosts to communicate through firewalls to attacker-controlled nameservers.

Data exfiltration and infiltration with DNS tunneling (Source – Palo Alto Networks)

DNS tunneling is stealthy due to the following three factors:-

Firewalls allow DNS traffic
Communication is indirect between the client and the server
Data encoding obfuscates payloads as legitimate traffic

It enables malicious command and control besides legitimate uses. Attackers exploit various DNS record types.

Apart from conventional command-and-control, DNS tunneling also facilitates tracking victims’ activities and scanning network infrastructure.

The “TrkCdn” campaign tracks email interactions by encoding victim data in unique subdomains, using 658 attacker-controlled domains resolving to 75 nameserver IPs.

The TrkCdn campaign uses DNS tunneling to track victims’ interactions with attacker-controlled email content. It encodes email addresses as MD5 hashes in unique subdomains like:-

“4e09ef9806fb9af448a5efcd60395815.trk.simitor.com for unit42@not-a-real-domain.com”

Querying these subdomains allows tracking when victims open emails or click links, enabling campaign monitoring.

The domains follow a lifecycle with incubation, active distribution, tracking, and retirement phases spanning over a year.

Attackers used specific hosting providers’ IP ranges. Another campaign, “SpamTracker,” similarly tracks spam delivery.

The “SecShow” campaign leverages DNS tunneling for network scanning by encoding target IP addresses and timestamps in subdomains to detect open resolvers, test delays, exploit vulnerabilities, and obtain TTL information, often precursors to attacks.

Mitigations

Here below we have mentioned all the mitigations:-

Limit resolver access to necessary internal networks or trusted IP ranges.
Configure resolvers to only respond to legitimate queries.
Implement access control lists (ACLs).
Stay vigilant for updates released by resolver software vendors and promptly apply patches.
Implement automated update mechanisms to ensure timely patching of resolver software.
Stay informed about N-day vulnerabilities affecting resolver software and prioritize patching accordingly.

IoCs

Domains Used For DNS Tunneling

85hsyad6i2ngzp[.]com
8egub9e7s6cz7n[.]com
8jtuazcr548ajj[.]com
anrad9i7fb2twm[.]com
aucxjd8rrzh7xf[.]com
b5ba24k6xhxn7b[.]com
cgb488dixfxjw7[.]com
d6zeh4und3yjt9[.]com
epyujbhfhbs35j[.]com
hhmk9ixaw9p3ec[.]com
hjmpfsamfkj5m5[.]com
iszedim8xredu2[.]com
npknraafbisrs7[.]com
patycyfswg33nh[.]com
rhctiz9xijd4yc[.]com
sn9jxsrp23x63a[.]com
swh9cpz2xntuge[.]com
tp7djzjtcs6gm6[.]com
uxjxfg2ui8k5zk[.]com
wzbhk2ccghtshr[.]com
y43dkbzwar7cdt[.]com
ydxpwzhidexgny[.]com
z54zspih9h5588[.]com
3yfr6hh9dd3[.]com
4bs6hkaysxa[.]com
66tye9kcnxi[.]com
8kk68biiitj[.]com
93dhmp7ipsp[.]com
api536yepwj[.]com
bb62sbtk3yi[.]com
cytceitft8g[.]com
dipgprjp8uu[.]com
ege6wf76eyp[.]com
f6kf5inmfmj[.]com
f6ywh2ud89u[.]com
h82c3stb3k5[.]com
hwa85y4icf5[.]com
ifjh5asi25f[.]com
m9y6dte7b9i[.]com
n98erejcf9t[.]com
rz53par3ux2[.]com
szd4hw4xdaj[.]com
wj9ii6rx7yd[.]com
wk7ckgiuc6i[.]com
secshow[.]net
secshow[.]online
secdns[.]site

IP Addresses Associated

35.75.233[.]210
202.112.47[.]45

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.