Hackers Abuse DNS Tunneling For Covert Communication & Firewall Bypass

As a sneaky scheme, hackers use DNS tunneling to bypass traditional security measures.

By wrapping malicious data inside DNS queries and responses, they can smuggle out sensitive information or talk to command and control servers without getting caught.

DNS tunneling provides an avenue for hackers to employ DNS protocols as covert channels of data exfiltration where the traffic appears legitimate on the face but it is not.

Besides this, it incorporates encryption capabilities that make it difficult for security systems to carry out thorough investigations into whether malicious traffic exists.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Cybersecurity researchers at Palo Alto Networks recently discovered that hackers have been actively leveraging the “DNS Tunneling” for tracking and scanning.

Hackers Abuse DNS Tunneling

While DNS tunneling is commonly used for covert C2 communications, cybersecurity analysts recently detected campaigns employing it for network scanning and tracking email delivery or CDN usage. 

For scanning, threat actors tunnel DNS queries to map a victim’s infrastructure. For tracking, they monitor DNS interactions related to malicious emails and CDNs. 

Embedding data in DNS requests and responses allows compromised hosts to communicate through firewalls to attacker-controlled nameservers. 

DNS tunneling is stealthy due to the following three factors:-

• Firewalls allow DNS traffic
• Communication is indirect between the client and the server
• Data encoding obfuscates payloads as legitimate traffic

It enables malicious command and control besides legitimate uses. Attackers exploit various DNS record types.

Apart from conventional command-and-control, DNS tunneling also facilitates tracking victims’ activities and scanning network infrastructure. 

The “TrkCdn” campaign tracks email interactions by encoding victim data in unique subdomains, using 658 attacker-controlled domains resolving to 75 nameserver IPs.

The TrkCdn campaign uses DNS tunneling to track victims’ interactions with attacker-controlled email content. It encodes email addresses as MD5 hashes in unique subdomains like:- 

• “4e09ef9806fb9af448a5efcd60395815.trk.simitor.com for unit42@not-a-real-domain.com”

Querying these subdomains allows tracking when victims open emails or click links, enabling campaign monitoring.

The domains follow a lifecycle with incubation, active distribution, tracking, and retirement phases spanning over a year. 

Attackers used specific hosting providers’ IP ranges. Another campaign, “SpamTracker,” similarly tracks spam delivery. 

The “SecShow” campaign leverages DNS tunneling for network scanning by encoding target IP addresses and timestamps in subdomains to detect open resolvers, test delays, exploit vulnerabilities, and obtain TTL information, often precursors to attacks.

Mitigations

Here below we have mentioned all the mitigations:-

• Limit resolver access to necessary internal networks or trusted IP ranges.
• Configure resolvers to only respond to legitimate queries.
• Implement access control lists (ACLs).
• Stay vigilant for updates released by resolver software vendors and promptly apply patches.
• Implement automated update mechanisms to ensure timely patching of resolver software.
• Stay informed about N-day vulnerabilities affecting resolver software and prioritize patching accordingly.

IoCs

Domains Used For DNS Tunneling

• 85hsyad6i2ngzp[.]com
• 8egub9e7s6cz7n[.]com
• 8jtuazcr548ajj[.]com
• anrad9i7fb2twm[.]com
• aucxjd8rrzh7xf[.]com
• b5ba24k6xhxn7b[.]com
• cgb488dixfxjw7[.]com
• d6zeh4und3yjt9[.]com
• epyujbhfhbs35j[.]com
• hhmk9ixaw9p3ec[.]com
• hjmpfsamfkj5m5[.]com
• iszedim8xredu2[.]com
• npknraafbisrs7[.]com
• patycyfswg33nh[.]com
• rhctiz9xijd4yc[.]com
• sn9jxsrp23x63a[.]com
• swh9cpz2xntuge[.]com
• tp7djzjtcs6gm6[.]com
• uxjxfg2ui8k5zk[.]com
• wzbhk2ccghtshr[.]com
• y43dkbzwar7cdt[.]com
• ydxpwzhidexgny[.]com
• z54zspih9h5588[.]com
• 3yfr6hh9dd3[.]com
• 4bs6hkaysxa[.]com
• 66tye9kcnxi[.]com
• 8kk68biiitj[.]com
• 93dhmp7ipsp[.]com
• api536yepwj[.]com
• bb62sbtk3yi[.]com
• cytceitft8g[.]com
• dipgprjp8uu[.]com
• ege6wf76eyp[.]com
• f6kf5inmfmj[.]com
• f6ywh2ud89u[.]com
• h82c3stb3k5[.]com
• hwa85y4icf5[.]com
• ifjh5asi25f[.]com
• m9y6dte7b9i[.]com
• n98erejcf9t[.]com
• rz53par3ux2[.]com
• szd4hw4xdaj[.]com
• wj9ii6rx7yd[.]com
• wk7ckgiuc6i[.]com
• secshow[.]net
• secshow[.]online
• secdns[.]site

IP Addresses Associated

• 35.75.233[.]210
• 202.112.47[.]45

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free