<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
On December 22, 2014 at 5:37:25 PM, Dave Aitel (<a href="mailto:dave@immunityinc.com">dave@immunityinc.com</a>) wrote:</div>
<blockquote type="cite" class="clean_bq"><span>
<div>
<div></div>
<div>Click here to view it: https://vimeo.com/115206626 <br>
<br>
It is hard to get out of a modern corporate network without a DNS <br>
channel. The simplistic benefit of INNUENDO's DNS channel over other <br>
random things like DNSCat is that you get encryption, redundancy, and <br>
ordering, all as part of the package. And we built in a burst-speed <br>
controller as part of the protocol (which I go over a bit in the movie). <br>
There's only one public paper I can see with realistic throughput <br>
numbers on DNS channels like this (although I distinctly remember <br>
Kaminsky playing video over DNS in one of his talks?), and it claims <br>
~1KB/s. With INNUENDO if you push the gauge up you can get 4KB/s, even <br>
with our additional signaling overhead. By default we stick to 1KB/s to <br>
avoid swamping intermediary DNS servers. <br>
<br>
In real-world terms: A screenshot is going to take you 33 seconds. <br>
Ideally you don't use your DNS channel as a massive exfil channel, but <br>
simply as a way to find a better path out of the network. <br>
<br>
As always, if you're interested in buying or evaluating INNUENDO please <br>
email admin@immunityinc.com <br>
<br>
Thanks, <br>
Dave Aitel <br>
Immunity, Inc. <br>
<br>
<br>
</div>
</div>
</span></blockquote>
<br>
<div>This sort of testing is something everyone should have on their TODO list.</div>
<div>Set up some sort of DNS tunnel for SSH, file exfiltration, remote desktop, .etc</div>
<div>and see what shows up in your SIM, your NBAD, .etc. and see how your </div>
<div>staff reacts to it. </div>
<div><br>
</div>
<div>Ron Gula</div>
<div>Tenable Network Security </div>
<div> </div>
</body>
</html>