NewsPublished 27 Oct 2025

Bytes over DNS · SANS Internet Storm Center

Source Reddit InfoSec News

Description

The 'Bytes over DNS' report from the SANS Internet Storm Center highlights a technique where data is covertly transmitted using DNS queries and responses. This method can be exploited for data exfiltration or command and control communication, bypassing traditional network security controls. Although no specific vulnerabilities or exploits are detailed, the technique poses a medium-level threat due to its stealth and potential misuse. European organizations, especially those with sensitive data and strict regulatory requirements, could face confidentiality risks if attackers leverage this method. Mitigation requires enhanced DNS monitoring, anomaly detection, and strict egress filtering to detect and block suspicious DNS traffic. Countries with advanced digital infrastructure and high adoption of DNS-based services, such as Germany, France, and the UK, are more likely to be targeted. Given the lack of direct exploits and the complexity of exploitation, the suggested severity is medium. Defenders should focus on improving DNS traffic visibility and implementing DNS security best practices to mitigate this covert channel threat.

Impact

For European organizations, the primary impact of this threat lies in the potential compromise of data confidentiality and integrity. Attackers leveraging DNS tunneling can exfiltrate sensitive information without triggering conventional security alerts, leading to data breaches and regulatory compliance violations under GDPR. The covert nature of the communication channel can also facilitate persistent C2 connections, enabling prolonged attacker presence and further network compromise. Availability impact is generally low unless attackers use DNS tunneling to orchestrate denial-of-service or other disruptive activities indirectly. The threat is particularly concerning for sectors with high-value data, such as finance, healthcare, and government institutions. Additionally, organizations with limited DNS traffic monitoring capabilities are at greater risk of undetected exploitation. The stealthy exfiltration can undermine trust in network security controls and complicate incident response efforts.

Defensive guidance

European organizations should implement advanced DNS monitoring solutions capable of inspecting DNS query and response payloads for anomalies indicative of tunneling activities. Deploying DNS traffic anomaly detection tools that analyze query length, frequency, and entropy can help identify suspicious patterns. Strict egress filtering policies should be enforced to limit DNS queries to authorized DNS servers only. Utilizing DNS security extensions (DNSSEC) and DNS over HTTPS (DoH) or DNS over TLS (DoT) can enhance DNS traffic integrity and confidentiality, though they may also require adapted monitoring strategies. Network segmentation and least privilege principles should be applied to restrict access to DNS services. Incident response teams should be trained to recognize DNS tunneling indicators and investigate unusual DNS traffic promptly. Regular threat intelligence updates and collaboration with DNS service providers can improve detection capabilities. Finally, organizations should consider deploying endpoint detection and response (EDR) tools that can detect suspicious processes initiating DNS tunneling.

Summary

The 'Bytes over DNS' technique involves encoding and transmitting arbitrary data within DNS queries and responses, effectively using the DNS protocol as a covert communication channel. This method can be employed by attackers to exfiltrate data from compromised networks or maintain command and control (C2) channels while evading detection by traditional security mechanisms that do not inspect DNS payloads deeply. The SANS Internet Storm Center's report, referenced via a Reddit InfoSec news post, does not specify a particular vulnerability or exploit but raises awareness about this technique's potential misuse. DNS tunneling tools and malware have historically used similar approaches to bypass firewalls and data loss prevention systems. The threat is challenging to detect because DNS traffic is ubiquitous and often allowed through perimeter defenses. No known exploits in the wild are reported currently, but the technique's stealthy nature warrants attention. The medium severity rating reflects the balance between the technique's potential impact and the current lack of widespread exploitation. Organizations need to consider DNS traffic analysis and anomaly detection as part of their security posture to identify such covert channels.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2025, 10:44 UTC

Technical details

References

Community reviews