Hosting images inside dns records using TXT.
Source Reddit NetSec
Description
I wrote a blog [post](https://asherfalcon.com/blog/posts/2) discussing how I hid images inside DNS records, you can check out the web viewer at [https://dnsimg.asherfalcon.com](https://dnsimg.asherfalcon.com) with some domains I already added images to like [asherfalcon.com](http://asherfalcon.com) and [containerback.com](http://containerback.com)
Impact
For European organizations, the primary impact of this technique lies in its potential misuse for data exfiltration, command and control (C2) communication, or bypassing security controls that do not inspect DNS payloads deeply. Organizations relying heavily on DNS for internal and external services might see increased DNS traffic or anomalous DNS record sizes, which could degrade DNS performance or trigger false positives in security monitoring. The covert nature of embedding images or arbitrary data in DNS TXT records could be exploited by advanced persistent threats (APTs) to hide malicious payloads or communications within legitimate DNS traffic, complicating detection efforts. This could affect confidentiality if sensitive data is exfiltrated, and availability if DNS infrastructure is overwhelmed by large or frequent TXT record queries. Integrity is less directly impacted unless DNS spoofing or poisoning is combined with this technique. European sectors with critical infrastructure, financial services, and large enterprises with complex DNS environments are particularly at risk. Additionally, organizations with strict data leakage prevention policies may find it challenging to detect data exfiltration via DNS TXT records used in this manner.
Defensive guidance
To mitigate risks associated with hosting images or arbitrary data inside DNS TXT records, European organizations should implement advanced DNS monitoring and anomaly detection that includes inspection of TXT record sizes and frequencies. Establish thresholds for acceptable DNS TXT record sizes and alert on unusually large or frequent TXT queries. Employ DNS security extensions (DNSSEC) to ensure integrity and authenticity of DNS responses, reducing the risk of spoofing combined with this technique. Use network segmentation and DNS filtering to restrict DNS queries to authorized servers and domains. Incorporate DNS traffic analysis tools capable of decoding and flagging suspicious encoded data patterns within TXT records. Regularly audit DNS records for unauthorized or unusual entries, especially large TXT records. Educate security teams about this novel technique to improve incident response capabilities. Finally, consider deploying DNS firewalls or recursive resolvers with enhanced security features that can detect and block anomalous DNS behaviors. These measures go beyond generic DNS security by focusing on the specific risks posed by embedding non-traditional data in DNS records.
Summary
The discussed security topic involves the unconventional use of DNS TXT records to host images by encoding image data within these records. This technique leverages the DNS infrastructure, which traditionally serves to resolve domain names to IP addresses and provide other domain-related information, to store and transmit binary image data encoded as text. The blog post referenced demonstrates how images can be embedded inside DNS TXT records and viewed via a web interface, effectively turning DNS into a rudimentary content delivery mechanism for images. While this is not a vulnerability in itself, it represents a novel use of DNS that could have security implications. DNS TXT records are typically used for domain verification, email security (SPF, DKIM), and other metadata. Using them to host images can increase DNS response sizes, potentially leading to DNS amplification or reflection attacks if abused. Additionally, this technique could be leveraged by threat actors to exfiltrate data covertly or to bypass content filtering, as DNS traffic is often less scrutinized than HTTP/HTTPS traffic. The approach does not exploit a software vulnerability but rather repurposes a legitimate protocol feature in an unexpected way. There are no known exploits in the wild related to this technique, and it does not require any specific software version or patch. The severity is assessed as medium due to the potential for misuse rather than direct exploitation. The technique requires control over DNS records of a domain, which implies authentication and domain ownership. User interaction is not necessary for the DNS queries themselves, but viewing the images requires a client capable of decoding and rendering the data. Overall, this represents an innovative but potentially risky use of DNS TXT records that could be abused for covert communication or evasion tactics in cyber operations.
- Source Type
- Subreddit
- netsec
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Domain
- asherfalcon.com
- Has External Source
- true
References
Community reviews
Related threats
- Breaking the AWS MCP Python SandboxMediumVulnerability
- Cloudflare's new PQ GeoKey Manager: keys that can only unwrap inside a chosen region, wrapped with hybrid ML-KEM + X25519News
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability
- Free real-time Certificate Transparency stream, no API keyNews
- Rockstar Games has now been compromised several different ways since 2018, and none of them were a zero-dayAnalysis