Re:BlueCoat and other proxies hang up during TLS 1.3
by deathanatos on Tuesday February 28, 2017 @01:48AM
(#13751816)
And how can your inspection points verify that data isn't being exfiltrated? Arbitrary pipes can be made over SSH, over DNS, and I don't really consider these advanced. How do you handle techniques like chaffing and winnowing, steganography, or someone who knows how to transmit an arbitrary number of bits using only two bits?
[ Parent
| on HN ]
Re:BlueCoat and other proxies hang up during TLS 1.3
by vidarh on Tuesday February 28, 2017 @04:56AM
(#13752586)
DNS is my favourite hack in that respect because so few people are aware of it.
For those who don't know, there are even full IP proxies that uses DNS [1], but you can hack up a primitive one using shell script by basically setting up a nameserver for a domain, turning on all query logging and using a shell script that splits your file up, encodes it into valid DNS labels and requests [some encoded segment].[yourdomain]. Now your file will be sitting in pieces in your DNS query log and all you need is a simple script to re-assemble it.
Best of all is that it works even if it passes through intermediary DNS servers, such as a corporate proxy, unless it's heavily filtered (e.g. whitelisting domains) or too rate limited to be useful.