Re: [Add] [EXTERNAL] Re: Malware adopting DoH

["Robert Mortimer" <[e-mail]>]

If google or any other TRR DoH provider start blocking malware by default surely that is filtering DNS which is the very problem that DoH is claiming to be solving? I'm not saying that filtering out malware is a bad thing - but if one of the core arguments for DoH is that filtering is bad and must never be done - then if they start filtering DNS is rather undermines what's meant to be the entire point of the initiative. As the claim then becomes "Filtering DNS is bad except when we do it".


I am well aware that this is an argument with the implementation and not the protocol but the "avoiding filtering" has been a core argument for the protocol as well  so now saying "actually filtering might be needed" is a bit of a bait and switch - especially when proponents of DoH have been claiming that such strategies aren't effective.

-- 
Robm
873
  "Ask not what I can do for the stupid, 
         but what the stupid can do for me" - Graeme Garden
On 13/09/2019 15:07:56, Ted Lemon <[e-mail]> wrote:
A question you might ask is, “how do we know that this malware is using DoH?”  Also, now that it is doing DoH, what new opportunities exist for stopping it?  Is it easier or harder to trick it?

It’s all very well and good to point out that it’s using DoH and that this blocks certain mitigation strategies, but eg if Google can mitigate it centrally we might be better off, not worse off, as a whole. 

On Sep 12, 2019, at 11:46, Dixon, Hugh <Hugh.Dixon=[e-mail]> wrote:



While tis true that there have always been other methods than Do53 for Malware C&C and exfil, the thing is that the existence of DoH services from Google (and other very large-scale internet entities) is (IMHO) quite a distinct change in the availability of
*the combination of* :
Conventionally-encrypted (as opposed to stick-out-like-a-sore-thumb custom/obscure)
Unauthenticated but via “public” infrastructure
Globally anycast-by-design (i.e. not trivially IP-detected-and-blocked like static IPs)
A wide spread of steady-flow “genuine” traffic (e.g. 24h peak-to-mean of ~ 2 for example for DNS) in which to hide
 
And possibly other things.
 
That doesn’t mean DoH isn’t a good thing as a DNS-on-the-wire-privacy and recursor-authentication protocol (as of course all these features are also what make it a great protocol for attempting to prevent downgrade attacks by what The Internet would call bad (network/nation-state) actors).  However, it does beg the question of (all) operators of DoH infrastructure as to whether they are delivering “a better internet” if they ignore the assistance to criminals that they offer if they don’t actively take a role against them.
Of course there’s an argument that a crook-enabling DoH server is better than an NXDOMAIN-hacking ISP DNS. And a lot of ISPs don’t do any actively-bad stuff with DNS data/responses but do apply malware mitigation.
 
To address the question, perhaps the “what can we do about mitigating the opportunities for harm generated through innovation?” is the better end point?
H
 
On 10/09/2019, 16:14, "Add on behalf of Alec Muffett" <[e-mail] [mailto:[e-mail]] on behalf of [e-mail] [mailto:[e-mail]]> wrote:
 
On Mon, 9 Sep 2019, 22:16 Bret Jordan, <[e-mail] [mailto:[e-mail]]> wrote:
Just making sure people here have seen this..
 
https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module [https://eur01..safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fthreat-insight%2Fpost%2Fpsixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module&amp;data=02%7C01%7Chugh.dixon%40sky.uk%7Cbe842998fe8f4078b46908d73601822c%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637037252427909693&amp;sdata=7V5bD7OSaLMqCAAqiL8oBg8F4HNgU8Qb2FnND9lWw9g%3D&amp;reserved=0]
 
 
One can only wonder how rapidly they adopted HTTPS to evade the "content fingerprinting" of anti-malware in the late 90s and early 2000s, and how the adoption curves compare?
 
Similarly for adopting Tor, also, of course. 
 
And WebRTC and Skype.
 
Not to mention those clever malware authors who hardcode IP addresses - that was a tremendous innovation in cyber badware.
 
Or were you suggesting that "innovation happens and bad people adopt it as well as good" somehow constitutes and argument towards some end?
 
-a
 
 
 
 
 
--------------------------------------------------------------------
This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by sending them to [e-mail] as attachments. Thank you
--------------------------------------------------------------------
 
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD --
Add mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/add