01What DNS exfiltration is
A program cuts a file into pieces, encodes each piece as letters and digits, and asks names such as 4a6f686e20446f652c207061737377.x.example.com. The name servers of that domain belong to the attacker: they receive the pieces, and their answers can carry orders back. Tools such as iodine or dnscat2 build a whole tunnel this way.
MITRE ATT&CK, the reference catalogue of the techniques of attackers, lists it under three techniques: T1048 (exfiltration over an alternative protocol), T1071.004 (command and control over DNS) and T1572 (protocol tunnelling).
02What Warda checks
On the card Data leaks through DNS of Protection settings (free, on by default), Warda reads the names asked, on the box, and nothing else: nothing is decrypted, and the names (the data) are never kept.
- Encoded names: the part under the domain is very long (100 characters or more), or its longest label has 20 characters or more and looks random: a high entropy with digits mixed in, or almost no vowels.
- Many of them: when one device asks 40 different encoded names under the same domain within 10 minutes, that domain is blocked for that device for 24 hours, and the administrators get an alert.
- From Warda 0.9.10, a second signal: when one device asks, within 10 minutes, 30 different names under one domain with an unusual record type (TXT, NULL, MX, CNAME, ANY…), the domain is blocked for that device too. Short names (under 8 characters below the domain) and labels starting with “_” — what mail servers and services ask all day: _dmarc, _domainkey, _spf — are left out. Warda 0.9.10 also lists the devices that ask another DNS server than Warda.
- The services that encode on purpose (the blocklists of mail servers, the lookups of antivirus software, the shared names of the clouds) are left out; Allow this domain lifts a block for a service you trust.
03What helps around it
A tunnel needs a domain of its own, often a new one. Other protections of Warda close the ways around:
- the category of the new domains, to block by profile, and the reputation of the domains, which asks the analysis service of Warda about a domain the household does not know well (the domain alone leaves the box);
- the category of the ways around the filter: the known DNS over HTTPS, VPN and proxy services, blocked for the children and teenagers, and iCloud Private Relay for their devices at home;
- the test name of Firefox, use-application-dns.net, answered as “does not exist”: Firefox then keeps the DNS of the network instead of its own.
04The limits, said plainly
- A query sent straight to 8.8.8.8 never reaches Warda: closing the DNS ports to the other devices is the job of the router.
- A slow leak is not seen: fewer than about 4 encoded names a minute (40 in 10 minutes), or 3 names of unusual types a minute (30 in 10 minutes), stays below the thresholds.
- A tunnel inside an encrypted connection to a public resolver (DNS over HTTPS on port 443) shows Warda nothing, unless the service is known and blocked.
- An alert says that a device behaves like a tunnel, not which program does it: check the device, and put it in quarantine while you do.