Technique that encodes data in DNS queries to bypass security controls and exfiltrate information.
DNS tunneling encodes data within DNS queries and responses, using the DNS protocol as a covert communication channel. Because DNS traffic is essential and often allowed through firewalls, DNS tunneling can bypass security controls to exfiltrate data, communicate with command-and-control servers, or access blocked services. Attackers encode stolen data in DNS queries that appear to be normal lookups but actually transmit information to attacker-controlled DNS servers. Detecting DNS tunneling requires analysing DNS traffic for anomalies.
Why It Matters
The DSC Perspective:
DNS tunneling represents a data exfiltration risk that bypasses traditional security controls. DNS security solutions that inspect DNS traffic can detect tunneling attempts. It's why 'allowing DNS' isn't risk-free.