Evading DNS Monitoring System with NULL Character
Zou Fu-tai · Xinxi wangluo anquan · 2012
DNS traffic measurement is widely used in Internet security management and researches.This article proposed a method to evade DNS monitoring system with NULL character contained in domain names.Experiments confirmed that this vulnerability exists in traffic analysis software such as Wireshark,Dnstop and Dsc,as well as multiple malware sandbox analysis systems and domain filtering devices.Application of this method in concealing malicious domain names and DNS covert channels is also discussed.