Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Security IT

Hackers Exploit a Blind Spot By Hiding Malware Inside DNS Records (arstechnica.com) 45

Hackers are hiding malware inside DNS records, allowing malicious code to bypass security defenses that typically monitor web and email traffic. DomainTools researchers discovered the technique being used to host Joke Screenmate malware, with binary files converted to hexadecimal format and broken into chunks stored in TXT records across subdomains of whitetreecollective[.]com.

Attackers retrieve the chunks through DNS requests and reassemble them into executable malware. The method exploits a blind spot in security monitoring, as DNS traffic often goes unscrutinized compared to other network activity.

Hackers Exploit a Blind Spot By Hiding Malware Inside DNS Records

Comments Filter:
  • 2004 called (Score:4, Funny)

    by DarkOx ( 621550 ) on Monday July 21, 2025 @01:46PM (#65534938) Journal

    Excuse me 2004 is on the line, and is wondering when 2025 plans to return its favorite side channel communications mechanism.

    • by GoTeam ( 5042081 )

      Excuse me 2004 is on the line, and is wondering when 2025 plans to return its favorite side channel communications mechanism.

      For the type they're talking about (hiding malware in hexadecimal format within the DNS records) is relatively new (I see some reference to it in 2017). The method that's been around forever has been hijacking your DNS records to redirect traffic from known "safe" sites, to their malware based copy.

      • by ls671 ( 1122017 )

        I think he is referring to vpn like and/or other type of channels which implement communication over dns and yes it's been around for quite a while.

      • it's totally harmless unless your machine is already compromised and has malware assembling dns request TXT records into executables.

        but that's not how the chicken littles of the security craze fad will squawk about it.

        • by GoTeam ( 5042081 )

          it's totally harmless unless your machine is already compromised and has malware assembling dns request TXT records into executables.

          but that's not how the chicken littles of the security craze fad will squawk about it.

          Very true. I was just noting the difference between the "older" DNS exploits and the "newer" ones. Both do require an internal compromise of your systems to be harmful, their methods are just different.

          • by ls671 ( 1122017 )

            Using vpn over dns or communicate over dns doesn't need anything to be compromised. See link below:
            https://github.com/AlexandreFe... [github.com]

            One would typically use it in a corporate environment to connect somewhere he can't otherwise at the risk of getting in trouble if he is discovered.

            • by GoTeam ( 5042081 )

              Using vpn over dns or communicate over dns doesn't need anything to be compromised. See link below: https://github.com/AlexandreFe... [github.com]

              One would typically use it in a corporate environment to connect somewhere he can't otherwise at the risk of getting in trouble if he is discovered.

              Heh, where I work, allowing someone to use a non-business related VPN is the compromising the environment. I suppose I'd also consider my ISP getting their infrastructure compromised counting as well (if we actually used their DNS...).

              • by ls671 ( 1122017 )

                My point was that you seem to be confusing DNS exploits with using DNS to communicate and exchange information, typically with TXT records as it is done for all kind of purposes.

          • by DarkOx ( 621550 )

            Yes i was thinking of VPN over DNS and things of that nature.

            I agree this is 'different' but the concept of using DNS infrastructure as a C&C channel or payload distribution mechanism is old. Threat actors have been ab-using DNS now for a long time, DNS should not be a 'Blind Spot' in the world of monitoring and detection.

        • Couldn't that malware be a browser opening a specially designed website/file that fetches the malicious records as part of loading external resources?
    • Because protection mechanisms for HTTPS are on the lookout for code broken into chunks and sent in hexidecimal while the DNS protections are not. Sure. Pull the other one.

      • this TXT record thing is harmless unless your machine is already compromised. TXT records don't get assembled into binaries and executed unless you've already completely and utterly lost the security battle

      • Because protection mechanisms for HTTPS are on the lookout for code broken into chunks and sent in hexidecimal while the DNS protections are not. Sure. Pull the other one.

        Servers on internal networks often do have outbound access to the internet denied by default, all port and protocols by a central firewall. DNS works differently, you send requests to a local server which forwards to an internet facing one.

    • Any fule knows it is always DNS.
  • by The-Ixian ( 168184 ) on Monday July 21, 2025 @01:51PM (#65534956)

    There are hundreds of ways to get code onto a computer. The trick is to not allow it to execute.

  • I am a bird and am free to sing beautiful birdsongs.

    • I am a crow and my ancestors have sung to me about the asshole farmers here that will try to spray u with BB's and eat u or wrap u in plastic.
      • I am a crow and my ancestors have sung to me about the asshole farmers here that will try to spray u with BB's and eat u or wrap u in plastic.

        Do people really eat crow? I thought it was just a figure of speech...

        • I looked it up, and Internet says "Historically, parts of East Asia, including China and South Korea"; "Some specific communities in Pacific Island cultures"; "Some Native American tribes." https://birdsnews.com/is-crow-... [birdsnews.com]

          • I should not be surprised. Someone, somewhere probably eats pretty much everything edible.
            • by BranMan ( 29917 )

              And whenever something is described as a "delicacy" translate in your head to "someone was at one time desperate enough to eat this".

  • by 93 Escort Wagon ( 326346 ) on Monday July 21, 2025 @02:13PM (#65534992)

    However, as the article points out - the attacker has to already have gotten operational software onto your system for this to be useful to them. If they're pulling pieces that aren't, in themselves, harmful... antivirus isn't going to flag the traffic regardless. Which is an approach we've known about for some time.

    • It could be something very lightweight that does nothing suspicious as it downloads a very malicious payload from so many sources that IDS and EDR can't detect it.

      I don't know about yours, but my DNS filters pretty much just look at A records.

    • by CAIMLAS ( 41445 )

      It's relying on LLMs being able to search the internet for things. It goes somethign like this:

      LLM searches for something, ends up on a site.
      Site has multiple links embedded in it with said DNS payloads.
      DNS lookup occurs.
      LLM 'reads' said payload.

  • by Nkwe ( 604125 ) on Monday July 21, 2025 @02:13PM (#65534994)
    The real malware is the code that is performing the DNS queries and assembling the results into other malware. Sure, this mechanism would bypass normal code scanning on Internet downloads, but that code scanning should have already caught the code making the DNS queries and executing the resultant binaries.
    • The real malware is the code that is performing the DNS queries and assembling the results into other malware.

      So: host, nslookup, dig, dnsip, and related tools are malware now? Including libresolv, and equivalents in Rust and Go? Also the Python standard modules, of course?

      • by allo ( 1728082 )

        The script that combines these to retrieve and execute malware is.

        • by suutar ( 1860506 )

          Yeah, but until someone notices, identifies it, and adds a signature for it, there's no indication that what it's doing is worse than legitimate tools =/

    • That's what I'm wondering.

      How is this any different from using FTP to download malware, and then execute it?

      Nothing in a DNS client is going to execute what is stored in a TXT record by itself. Nothing in any DNS client is going to unzip / un-base64 it, mark it executable, and run it without someone being there to do that, or some script being written to do it that is being executed with the requisite permissions, so this is no different than any other file transfer medium other than being obfuscated in a

  • by allo ( 1728082 )

    It's not like your computer is assembling TXT records into binaries on its own. The malware is already on the device, the TXT records are only additional data.

    • Windows 11 discovered to be doing this by default as a "feature" in 3, 2, 1...

    • Can't websites do that? MXToolbox.com shows me the content of TXT records all the time. Why couldn't MXToolb0x.com do the same, but assemble the fetched records into something unfriendly?
      • Hex is just hex until you chmod it -x.

        I've got the DeCSS T-shirt, but it can't execute the code printed on it. At least, I don't think so, I've never thought of waving it in the general direction of a DVD to find out...

    • It's very critical additional data, though. The idea is the basic malware doesn't have anything truly alarming in it, so it's easier to obfuscate it to slip by the filters. Once it's running, it can download the really dangerous stuff via TXT records, which won't be checked for alarming/dangerous content, and set that up behind the filters without triggering them. It does all that in memory, without giving any indication of touching files, and then once the code's gotten root access it can persist things to

  • This is compounded by the (ab)use of TXT records to store arbitrary records without needing to extend the set of DNS record types. Having explicit types of DNS records improves syntax filtering, making it difficult to impossible to abuse those records this way. Limiting TXT records to only their original purpose (instead of putting SPF, DMARC, DKIM and other types inside them) would allow heavy-handed filtering of attempts to pass arbitrary data in large quantities through TXT records without impacting any

  • I recall someone hacking the Dutch Greenpoint phones by sending all traffic over a DNS server in 1992.

Gravity brings me down.

Working...