How much can actually leak

How much can actually leak

Worth being realistic, because over-claiming here loses engineers.

A DNS channel carries perhaps 50 useful bytes per lookup. A search query might carry a few hundred. A rendered image URL carries as much as the URL length allows, which is thousands. An email carries everything.

So the channels differ by four orders of magnitude, and the response should differ too. An attacker with DNS alone extracting a customer database is doing thousands of lookups over hours, which a budget catches and an alert surfaces. An attacker with one rendered image URL gets a credential in a single turn, with nothing to notice.

Rank the work by bandwidth. Images and mail first. DNS last, and mostly with a budget rather than a block.

Failing closed

try
{
    if (!_budget.TryConsume(payload.Length))
        return EgressResult.Denied("budget-exhausted");

    return await _transport.SendAsync(payload, ct);
}
catch (Exception ex) when (ex is not OperationCanceledException)
{
    _audit.RecordFailure(destination, ex);
    return EgressResult.Denied("egress-policy-unavailable");
}

If the policy cannot be evaluated, nothing goes out. An agent that stops sending mail when its allowlist service is down is an incident someone fixes in an hour. An agent that sends mail anyway is a breach somebody else discovers.

What breaks first

This is the chapter that generates complaints, and they arrive in a predictable order.

Images stop rendering. Product will notice within a day. The answer is server-side proxying, not an exception.

A legitimate integration breaks because its host was not on the list. Correct behaviour, mildly embarrassing, fixed by adding the host. Build the allowlist from your existing traffic before you enforce it, then run in report-only mode for a week and read what it would have blocked. That week will also tell you things about your system you did not know.

Someone asks for a wildcard. *.example.com is usually fine. * is a request to delete this chapter. The middle cases need a real conversation, and the useful question is who else can publish on that host.

What this costs

Less than any other chapter here, which is why it goes first when time is short. A renderer, a policy, a budget and an allowlist is a few days of work and does not require touching the agent loop.

The recurring cost is allowlist maintenance, which is unglamorous and never finished. The one-time cost is a week of people telling you their integration broke.

Set against that: this closes the leg that carried EchoLeak, and it does so without needing to detect anything, classify anything, or be right about intent.

Chapter 11 deals with the case where the agent does not need to send your data anywhere, because it is running code on your machines.

Sources for this chapter

The three rules, the SafeRenderer, the IsAllowed policy including the refusal of tainted query strings, and the egress budget are the author's designs. The claim that closing this leg stops "a large share" of published exploits is an assessment from the mechanism and the incident record rather than a measured proportion; no one has published that number and this book does not invent one. The recommendation to strip images unconditionally is a strong opinion that some teams will reasonably reject on product grounds. The DNS channel is well established in exfiltration literature generally and has not been demonstrated against an agent by this author.