QUIC-Exfil: Exploiting QUIC's Server Preferred Address Feature to Perform Data Exfiltration Attacks
Thomas Grübl, Weijie Niu, Jan von der Assen, Burkhard Stiller · 2025
The QUIC protocol is now widely adopted by major tech companies and accounts for a significant fraction of today's Internet traffic.QUIC's multiplexing capabilities, encrypted headers, dynamic IP address changes, and encrypted parameter negotiations make the protocol not only more efficient, secure, and censorship-resistant, but also practically unmanageable by firewalls.This opens up doors for attackers that may exploit certain traits of the QUIC protocol to perform targeted attacks, such as data exfiltration attacks.Whereas existing data exfiltration techniques, such as TLS and DNS-based exfiltration, can be detected on a firewall level, QUIC-based data exfiltration is more difficult to detect, since changes in IP addresses and ports are inherent to the protocol's normal behaviour.To show the feasibility of a QUIC-based data exfiltration attack, we first introduce a novel method which leverages the server preferred address feature of the QUIC protocol and, thus, allows an attacker to exfiltrate sensitive data from an infected machine to a malicious server, disguised as a server-side connection migration.The attack is implemented in the form of a proof of concept tool in Rust.We evaluated the performance of five anomaly detection classifiers -Random Forest, Multi-Layer Perceptron, Support Vector Machine, Autoencoder, and Isolation Forest -trained on datasets collected from three distinct network traffic scenarios.The classifiers were trained on ∼ 700K benign and malicious QUIC packets and 786 connection migration events, but were unable to effectively detect the data exfiltration attempts.Furthermore, post-analysis of the traffic captures did not reveal any identifiable fingerprint.As part of our evaluation, we also interviewed five leading firewall vendors and found that, as of today, no major firewall vendor implements functionality capable of distinguishing between benign and malicious QUIC connection migrations.