Robin, an attacker, is attempting to bypass the firewalls of an organization through the DNS tunneling method in order to exfiltrate dat a. He is…

DNS tunneling is a technique used to bypass firewalls by encapsulating non-DNS traffic within DNS queries and responses. The NSTX (Nostromo) tool is specifically designed for this purpose. Since the Domain Name System (DNS) protocol operates on port 53 (both UDP and TCP), any tool performing DNS tunneling must use this port to communicate with a malicious DNS server. Firewalls are almost universally configured to allow outbound traffic on port 53 to permit legitimate name resolution, which is why attackers leverage it for covert data exfiltration.

B. Port 23: This port is used for Telnet, an unencrypted remote terminal protocol. It is unrelated to DNS tunneling and is often blocked by firewalls due to its insecurity.

C. Port 50: This port is used for the Encapsulating Security Payload (ESP) protocol, a component of IPsec used for VPNs. It is not associated with DNS.

D. Port 80: This port is used for HTTP. While HTTP tunneling is another firewall bypass technique, the question specifically asks about DNS tunneling with the NSTX tool.

1. Internet Engineering Task Force (IETF). (1987). RFC 1035: Domain Names - Implementation and Specification. Section 4.2

"Transport

" specifies that DNS transactions use UDP or TCP on port 53. This establishes port 53 as the standard for the protocol being tunneled.

2. Farnham

G. (2013). Detecting DNS Tunnelling. SANS Institute InfoSec Reading Room. Page 4 states

"DNS tunnelling works by encoding data into DNS queries and sending them to a name server the attacker controls... Since DNS traffic is on port 53 and is almost always allowed out of a network

this is an effective way to bypass most firewalls."

3. Dusi

M.

Gringoli

F.

& Salgarelli

L. (2011). A preliminary look at the privacy of DNS-based covert channels. In 2011 IEEE International Conference on Communications (ICC) (pp. 1-5). IEEE. DOI: 10.1109/icc.2011.5963359. The paper's introduction discusses how DNS-based covert channels operate over port 53 to bypass network access policies.