Network Access, Visibility, and Enforcement · Topic 4 of 6
Data Exfiltration Techniques and How to Detect Them
Explain data exfiltration techniques such as DNS tunneling, HTTPS, email, file transfer, ICMP, chat, NTP and cloud storage, and the signs that reveal them.
- 5 min
- DNS tunneling hides data in query names, and shows as long names and many unique subdomains.
- HTTPS exfiltration blends with web traffic, so use reputation, inspection and flow analysis.
- ICMP tunnels hide data in echo payloads, and show as large or frequent pings.
What it is
Exfiltration is the unauthorised transfer of data out of an organisation, and attackers choose channels that look like normal traffic.
After attackers get in, they find valuable data and must move it out. A defender who blocks only the obvious channels will miss the rest. Almost any protocol that can leave the network can carry data, so you need to know the common ones and their signs.
How it works
Each channel has a typical method, a reason attackers use it, and a way to spot it.
DNS tunneling
DNS is allowed almost everywhere, since hosts need it. In DNS tunneling, the attacker encodes data in the names of queries to a domain they control. Their name server reads the queries, and sends replies that carry commands or more data.
Normal query: host1.example.com
Suspicious query: MFRGGZDFMZTWQ2LKNNWG23TPOBYXE43UOV3HO6DZ.t.example.net TXTSigns are very long names, many unique subdomains of one domain, a high volume of queries, and use of unusual record types such as TXT. Detection uses DNS analytics and a DNS security service. Force hosts to use only your own resolvers, so you can inspect and filter the traffic.
HTTPS
Attackers often send data over HTTPS, because the traffic blends in with web browsing and is encrypted. The destination may be a server they own, or a legitimate site that they abuse.
Signs are large uploads to unfamiliar sites, new or low reputation domains, regular beacon like timing, and unusual user agents. Detection uses a proxy with TLS inspection, reputation and flow analysis. Encrypted traffic analytics can find suspicious patterns even without decryption.
Email can carry attachments, or the body of a message can hold data. Attackers also create forwarding rules that copy mail to an outside address, and some use personal webmail from a work computer.
Signs are large attachments to external addresses, mail to personal accounts, and new forwarding rules. Detection uses DLP on the mail system, and alerts on inbox rule changes.
FTP, SSH, SCP and SFTP
These are file transfer tools. FTP sends in clear text. SSH carries encrypted sessions, and SCP and SFTP are file copy methods that run over SSH, normally on TCP port 22.
Signs are file transfers to external addresses that are not part of the business, and long lived, high volume SSH sessions. Because SSH is encrypted, rely on flow data, egress rules and an allow list of destinations.
ICMP
ICMP echo, or ping, packets have a data field. In an ICMP tunnel, an attacker hides data in that field. Many networks allow ping outbound, so the traffic passes.
Signs are echo packets with unusually large payloads, a high rate of pings to one external host, and replies that are not what a normal ping returns. Control by limiting outbound ICMP, and by alerting on large or frequent echo packets.
Chat, messaging and IRC
Messenger and chat applications can transfer files and text. Internet Relay Chat (IRC) is an old chat protocol that botnets have long used for command and control and for data transfer. IRC normally uses TCP port 6667, and 6697 for TLS.
Signs are chat traffic from servers or from users who have no reason to use it. Block unapproved chat applications by application control, and watch for IRC on servers.
NTP
Network Time Protocol uses UDP port 123, and it is rarely inspected. Fields in NTP packets can be abused to hide small amounts of data, a covert channel technique described in security research. It is a low bandwidth channel, and it is hard to see because few teams inspect NTP.
Signs are NTP traffic to servers that you do not use, or hosts with an unusually high NTP rate. Allow hosts to talk only to your own time sources.
Cloud storage
Attackers upload data to cloud storage and file sharing services, such as personal storage accounts. The service is trusted, uses HTTPS and is often allowed by policy.
Signs are large uploads to storage services, and uploads to a personal account instead of the company tenant. Controls include a CASB, tenant restrictions that allow only the corporate account, and DLP on uploads.
General defences
| Defence | Effect |
|---|---|
| Egress filtering with default deny | Only needed outbound protocols and destinations pass |
| DNS security | Blocks tunnelling and bad domains |
| TLS inspection and proxy | Lets you see HTTPS content, where policy allows |
| DLP | Detects sensitive data in motion |
| Flow analytics and baselines | Finds unusual volumes and destinations |
| Segmentation and least privilege | Limits what an attacker can collect |
What to remember for the exam
Seven facts cover most questions on this topic.
- DNS tunneling hides data in query names, and shows as long names and many unique subdomains.
- HTTPS exfiltration blends with web traffic, so use reputation, inspection and flow analysis.
- ICMP tunnels hide data in echo payloads, and show as large or frequent pings.
- SCP and SFTP run over SSH, normally on TCP 22.
- IRC normally uses TCP 6667, and 6697 for TLS.
- NTP uses UDP 123 and can be abused as a low bandwidth covert channel.
- Default deny egress, DNS security, DLP and flow baselines are the main defences.
When a question describes very long, random looking subdomains of one domain, the answer is DNS tunneling.
Common mistakes
These four mistakes appear often.
Trusting protocols that are always allowed. Attackers choose DNS, HTTPS and ICMP exactly because they are allowed.
Blocking only one channel. Attackers switch to another, so apply layered controls.
Ignoring small, slow transfers. A low and slow channel may avoid volume alerts.
Letting hosts use any DNS server. You then cannot see or control the queries.
Decrypting traffic raises privacy and legal questions. Apply inspection only as your policy and local rules allow.
Check yourself
Work through these three questions.
What are the signs of DNS tunneling?
Very long query names, many unique subdomains of one domain, a high query volume and unusual record types such as TXT.
Why is a default deny egress policy useful?
It allows only the outbound protocols and destinations that the business needs, so most covert channels are blocked.
Which ports do SCP and SFTP normally use?
They run over SSH, normally on TCP port 22.
Topic 4 of 6 in Network Access, Visibility, and Enforcement
Test yourself on Network Access, Visibility, and Enforcement
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.