Hello, everybody. Welcome to our last talk of the day. This is Peter Lowe.
Am I going to be able to see them on the screen as well?
No.
Okay, I can look around.
Yeah.
Hello, this is Peter Lowe. He will be showing us many of the weird things people have done
with DNS to finish our day.
Thank you.
The first thing I should say is that this presentation normally takes about 40 minutes
because there's quite a lot of things to see, so I'm going to be running through it.
It's going to be a whirlwind tour of bizarre and unusual things that people have done with DNS.
Okay, so I'm going to skip through some of this stuff.
This is all about who I am.
Normally, I talk about myself a little bit, but nobody's really interested in that.
You've come to see the weird stuff, right?
I'm a security researcher.
I do DNS stuff, basically.
Bunch of different titles for this.
Not very click-baity.
This is a sort of intro to DNS.
I'm assuming that everybody kind of knows what that is here, so we'll skip over that.
And this is how it all started, which is part of the DNS abuse special interest group.
For first, I'm the co-chair John Todd from Quad9 joked about some malware distribution via DNS,
and we thought, oh, that's not possible.
Wait, hang on.
So I started going and collecting some other stuff.
Yes, a lot of these aren't around anymore.
Unfortunately, it's kind of like a museum of weird DNS things.
Some of them still work, but there's a bunch of links at the end.
If you're interested in any of these, I've tried to put resources and links to everything that you'll see.
So first section, trace routes.
Not 100% DNS, but basically it works by setting up a static route
and then making sure that the reverse DNS maps back to something interesting.
So this was one of the first things I ever saw, the Star Wars intro via DNS.
It was by a guy called Ryan.
I'm going to be looking up at here as well, by the way, because I can't remember all the details with these.
Ryan Werber from Beald on it in 2013, it was one of the things I saw and thought, oh, how does that work?
And it kind of got me interested in some of the stranger parts of DNS.
There's an IPv6 version out there somewhere.
It went down very quickly because of a DDoS, typical for a lot of these things, unfortunately.
There is this one, which is hand.bb0.nl.
This, as you can see, displays a hand, and it's done over IPv6.
If you increase the number of hops, it does get more interesting as it goes on.
This is the only space I had for on the slide, so, yeah.
Sebastian Haas, who will be featured multiple times in this presentation.
I hope he's here, but if not, hi, Sebastian.
He put up a thing where you could trace it and find the live scores from the Euro 2020 match, which was pretty impressive.
He also wrote a thing called Fake Root, or Faker Tea, which allows you to set up IPv6 routes on your local machine.
This is another one from MakerForce.
This is some alternate lyrics to American Pie, which I'm sure you're all familiar with.
Bad Horse, if anybody here is a fan of Dr. Horrible Singalong, there is a semi-famous thing in it called Bad Horse,
where he sings a little song, and we have the lyrics here.
If you go and have a look at the SSL certificate chain for Bad.Horse, yeah, signed up Bad.Horse,
there's a Lalisa Reg there as well.
This is a screenshot of Dr. Horrible.
And the first time I did this, Andrew Campling, who's an encrypted DNS guy and other stuff,
he said, let's put something festive in so I went out and had a look.
And of course, someone's done a Christmas tree, so there's not one.
Toys and Toys.
One of the first things I found was at Postel.org, which I think is a great place to be hosting something interesting.
It's a calculator.
It's not as good as Stefan Bolzmeier's, where you can actually put the plus character in,
and it's not around anymore.
I put this.
There's a reverse Polish calculator out there.
Apparently, this is a reverse Polish calculator, so it shows how much I know about maths.
This is one of the more interesting ones.
There's a bunch of different versions of this.
It's a local IP echo.
It tells you what your public-facing IP address is.
It's actually quite useful because in scripts,
instead of just doing a curl request in my IP.org or whatever,
this is going to get an answer much quicker and it's much more easily scriptable.
Yes, this one is the MyIP service from Google.
As everybody knows, Google is famous for discontinuing services,
but they're never going to let the DNS service go.
So, yeah.
There's some tools here for network admins, some IP to ASN translators, lots of different options.
There's Team Cummry. There's an example here. There's some other ones out there if you go looking for them.
There is an example here.
I think this is from Tony Finch.
This is postcodes, which will translate them to...
Oh, and Jan-Pitt means...
Sorry.
This will give you the geolocation for postcodes in the UK.
I think Jan-Pitt did some...
Oh, yeah. This is also the airport codes, I think.
I'm also missing my talk...
Speaker notes, by the way, so forgive me for this.
And DNS top toys. This is a great site.
They put up a bunch of different things that you can look at.
There's world time, IP Echo, another one.
Number two words. I genuinely don't know what this is useful for.
I don't know why anybody would use it, but it's kind of fun to have it.
This is one of my favorite ones.
I'm quite a fan of geocaching.
I don't know if you guys know about it, but it's like Pokemon Go for geeks.
And you get to go out in the world and find things that are out there.
There is one geocache which has the author of Mocha Petrius,
but it's unfortunately not Dr. Paul Mocha Petrius.
This is, again, Sebastian Haas, I think.
And it's basically a host name, and if you look up the text record for it,
it gives you the hint for the first part of the geocache,
which is, I love it, personally.
There's a text adventure out there.
This is very cool.
I mean, this is what you want from DNS, right?
A guy called Craig Mayhew, you look up different host names,
and it gives you different options,
and he uses round-robin DNS for random decision trees.
So it's pretty cool.
Tunneling.
OK, so people's definition of tunneling varies, right?
It could be a simple kind of like C2 communication,
or it could be full file extraction over DNS.
I've got some examples here.
If you want to discuss what tunneling means exactly,
let's meet afterwards and fight.
This is an intro to tunneling, which I found from Slashdot in 2000,
but the general concept is the same.
Wikipedia over DNS by a guy called David Ledbetter.
This is very cool.
It actually supports Unicode as well.
I don't think it works anymore, unfortunately,
but it is basically, he took a local copy of the XML dump
and then installed it, I think, on Power DNS,
and you could look up pages via that.
Blogging, another very cool example where you look up,
you publish text records, and that is your static blog.
I love it because it's going to be fast.
It actually works.
From a blog, all you really want is the content.
So, yeah, you can get the index.
You can get, look up specific posts,
or order them by recently post, really recently posted.
OK, so now we're getting a little bit more into the words.
This is IP over DNS.
There is a library out there called Iodine,
which is the chemical element number 53,
which is appropriate.
It does full IP over DNS.
There's some examples of how this can be used later on.
I don't, I'm getting to the point where I lose words
about how to describe this kind of stuff.
I mean, it's all brilliant, but this is like,
yeah, I don't know.
HTTP over DNS, so we're getting even more crazy here.
This is browser tunnel.
It's actually quite useful for some things
if you're in certain situations like an airport
or something like that where things might be a bit restricted.
This is basically how it works.
It does raise the interesting concept of,
if you're familiar with DNS over HTTPS,
HTTP over DNS over HTTPS.
So, yeah.
This is pretty cool.
It's called Slow DNS and it's a full VPN over DNS
which is in the Google Android, the Google Play Store.
I haven't used it because it does include ads
and I've never actually got the courage to check it out properly.
But I think it's the kind of thing that can really work
in airports and other restricted areas.
So it's, you run it and it's a VPN
that lets you access the internet and it works over DNS.
So a lot of places DNS is going to be unrestricted
and this is going to help you out in those situations.
The ads thing, well, you know, give it a go,
but the concept is amazing.
Another library that I found really cool
is called DNS Cat 2.
You install a server and you install a client
and then they communicate to each other over DNS packets.
You don't have to have an actual domain working at all.
You don't have to register a domain.
It just uses the DNS protocol
and it's got a bunch of built-in functions
like sending files and windows and messages
and stuff like that.
It's very cool.
This is still on GitHub.
There's a link at the end.
You'll see.
And a few other things.
How much time?
Oh, am I out of time?
Okay.
The benefits of being the last person speaking.
Corey Quinn talked about how you can use DNS
as a full config management system.
This is the BIMI brand indicators,
which works over DNS.
It uses TXT records, which start with underscore BIMI.
A full contacts database.
Somebody in the UK has created a whole protocol
and used it to put the yellow pages online
and they've got an SDK and all sorts of crazy stuff.
There is dskv.com.
This is a full key value store.
This works.
This guy is quite dedicated to it.
I have to say I'm quite impressed.
It's a really good documentation.
Go check it out.
A file system over DNS.
Yeah.
I know.
Right?
I mean, why not?
Okay.
Ben Cox was in the audience when I did this presentation once
and I had to say I totally lost my...
It's amazing.
And there's an example of him on Twitter streaming named P3
over DNS and it working.
It's just a magical...
Here you go.
Here's the links at the end and questions.
There you go.
Thank you.
Any questions for Peter?
No?
No.
Thank you Peter.
Thank you all for being here.
Have a good day.