{"id":90406,"date":"2020-08-01T01:41:57","date_gmt":"2020-07-31T23:41:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu"},"modified":"2020-08-01T01:41:57","modified_gmt":"2020-07-31T23:41:57","slug":"chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/chto-takoe-dns-tunnelirovanie-instrukcziya-po-obnaruzheniyu","title":{"rendered":"\u00c7far\u00eb \u00ebsht\u00eb tunneling DNS? Udh\u00ebzues p\u00ebr zbulimin","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"\u00c7far\u00eb
\n
\nDNS tunneling transforms the domain name system into a weapon for hackers. DNS is essentially a vast phone book of the internet. Additionally, DNS is a fundamental protocol that allows administrators to query the DNS server's database. So far, everything seems clear. But clever hackers realized that they could secretly communicate with the victim's computer by embedding control commands and data into the DNS protocol. This idea is the foundation of DNS tunneling.
\n<\/a><\/noindex><\/p>\n

How DNS Tunneling Works<\/h2>\n

\n\"\u00c7far\u00eb
\n
\nEverything on the internet has its own dedicated protocol. And DNS supports a relatively simple protokolli <\/a><\/noindex>request-response model. If you want to see how it works, you can run nslookup \u2013 the primary tool for sending DNS queries. You can request an address simply by specifying the domain name of interest, for example:<\/p>\n

\"\u00c7far\u00eb
\n
\nIn our case, the protocol responded with the IP address of the domain. In DNS protocol terms, I made an address query or an 'A' type request. There are other types of requests, and the DNS protocol will respond with various data fields that hackers can exploit, as we will see later.<\/p>\n

In any case, at its core, the DNS protocol handles the transmission of a request to the server and its response back to the client. But what if an attacker embeds a hidden message within the domain name request? For example, instead of entering a perfectly legitimate URL, they input data they want to transmit:<\/p>\n

\"\u00c7far\u00eb
\n
\nLet's assume the attacker controls the DNS server. They could transmit data \u2013 for instance, personal information \u2013 and it wouldn\u2019t necessarily be detected. After all, why would a DNS query all of a sudden become something illegitimate? <\/p>\n

By controlling the server, hackers can forge responses and send data back to the target system. This allows them to transmit messages hidden within various fields of the DNS response to malware on the infected machine, with instructions such as searching within a specific folder.<\/p>\n

The 'tunneling' part of this attack is centered on hiding <\/a><\/noindex> data and commands from detection by monitoring systems. Hackers can use sets of symbols like base32, base64, etc., or even encrypt the data. Such encoding will go unnoticed by simple threat detection utilities that search for plain text.<\/p>\n

Dhe \u00ebsht\u00eb DNS-tunneling!<\/p>\n

Historia e sulmeve p\u00ebrmes DNS-tunneling<\/h2>\n

\n\u00c7do gj\u00eb ka nj\u00eb fillim, p\u00ebrfshir\u00eb iden\u00eb e kapjes s\u00eb protokollit DNS p\u00ebr q\u00ebllime hakerimi. N\u00ebse mund t\u00eb gjykojm\u00eb, e para diskutimi <\/a><\/noindex>nj\u00eb sulm t\u00eb till\u00eb ishte kryer nga Oskar Pearson n\u00eb list\u00ebn e post\u00ebs Bugtraq n\u00eb prill 1998.<\/p>\n

Deri n\u00eb vitin 2004, DNS-tunneling u prezantua n\u00eb Black Hat si nj\u00eb metod\u00eb hakerimi n\u00eb nj\u00eb prezantim t\u00eb Dan Kaminsky. K\u00ebshtu, ideja u shnd\u00ebrrua shum\u00eb shpejt n\u00eb nj\u00eb mjet t\u00eb v\u00ebrtet\u00eb sulmi.<\/p>\n

Sot, DNS-tunneling ka pozita t\u00eb forta n\u00eb hart\u00ebn k\u00ebrc\u00ebnimeve t\u00eb mundshme <\/a><\/noindex>(dhe bloger\u00ebt n\u00eb fush\u00ebn e siguris\u00eb informatike shpesh k\u00ebrkohen p\u00ebr ta shpjeguar at\u00eb).<\/p>\n

A keni d\u00ebgjuar p\u00ebr Sea Turtle <\/a><\/noindex>? \u042d\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043e\u043a \u2014 \u0441\u043a\u043e\u0440\u0435\u0435 \u0432\u0441\u0435\u0433\u043e, \u0441\u043f\u043e\u043d\u0441\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0433\u043e\u0441\u0443\u0434\u0430\u0440\u0441\u0442\u0432\u043e\u043c, \u2014 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u043d\u0430 \u0437\u0430\u0445\u0432\u0430\u0442 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u0446\u0435\u043b\u044c\u044e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f DNS-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0443\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u00ab\u043f\u043b\u043e\u0445\u0438\u0435\u00bb IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0435\u0431-\u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u2014 \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, Google \u0438\u043b\u0438 FedEx. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043c\u043e\u0433\u0443\u0442 \u0437\u0430\u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438 \u043f\u0430\u0440\u043e\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0435 \u043d\u0435\u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e \u0432\u0432\u0435\u0434\u0443\u0442 \u0438\u0445 \u043d\u0430 \u0442\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430\u0445. \u042d\u0442\u043e \u043d\u0435 DNS-\u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435, \u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e \u0441\u043a\u0432\u0435\u0440\u043d\u043e\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438.<\/p>\n

K\u00ebrc\u00ebnimet e DNS-tunneling<\/h2>\n

\n\"\u00c7far\u00eb
\n
\nDNS-tunneling \u00ebsht\u00eb si nj\u00eb tregues i fillimit t\u00eb nj\u00eb faze t\u00eb keqe t\u00eb lajmeve. \u00c7far\u00eb lloj? Ne tashm\u00eb kemi folur p\u00ebr disa, por le t\u00eb strukturojm\u00eb ato:<\/p>\n