DNS tunneling

DNS tunneling is a technique that involves encasing non-DNS traffic within DNS packets to bypass network security controls. The DNS protocol is used for legitimate purposes, such as translating domain names to IP addresses, but attackers can abuse this protocol to send unauthorized data or commands.

Here’s a simplified overview of how DNS tunneling works in Figure 7.3:

Figure 7.3 – Real DNS query and answer

Figure 7.3 suggests that malware residing within the victim’s computer initiates a compromised DNS query devoid of a legitimate DNS answer, including an IP address. This query appears as a random and nonsensical DNS request, concealing encrypted data within its structure. Since there is no registration for such a domain name, only the attacker’s deceptive DNS server can intercept and respond to this query.

By possessing the decryption key, the attacker can extract the concealed data from the DNS query...