Re: [PEN-TEST] IP Tunneling over DNS

[Eric Thiel <ethiel () EVIDENTSOLUTIONS COM>]

I think a lot of people are missing the real danger here.

Say I run a firewall that does not allow any traffic from SubnetA to the
internet, since there have been problems with people in the department
uploading confidential data outside the company. Before this announcement I
assumed there was no way for people to get traffic out (without ANY open
ports, no tunnels are possible). Now anyone on SubnetA that can talk to a
DNS server in SubnetB (SubnetB is allowed to pass DNS traffic to the
Internet) can create a bi-directional tunnel out to the Internet.
Furthermore, unless I have some heavy logging on the DNS server, I have no
idea who is sending all the traffic.

Eric D. Thiel


-----Original Message-----
From: Pawel Maciejewski [mailto:lukeskyw () SOWATECH COM PL]
Sent: Monday, September 11, 2000 2:14 PM
To: PEN-TEST () SECURITYFOCUS COM
Subject: Re: [PEN-TEST] IP Tunneling over DNS


I think you can use for tunnelling almost every IP protocol, which will pass
through firewall and routers to the Internet. ICMP is one of the ways, maybe
easiest to implement.

But i think that tunnelling is not so dangerous as passive trojans.

In example : hacker sends spoofed e-mail from Windows Update to some user
who works in some company. The user unpacks, and installs fake "update", and
in a matter of fact he installs a passive client-trojan, which determines
what type of packets are allowed to go outside, is this workstation using a
proxy server etc..., and connects to some server, with installed
server-trojan on it (using allowed protocols or even proxy commands). The
trojan-client gets commands from the bogus-server, and then sends the
results to it (same, using allowed protocols, or proxy, it doesnt matter).
Think about things you can implement into your trojan client/server :) It
can be almost everything...

Greetings

-= Signed =-
-= Pawel Maciejewski =-

"I had a dream I was a Jedi"
----------------------------
include <netinfo.h>
char e-mail[]="lukeskyw () sowatech com pl";
char www[]="http://skywalker.hack.pl";;