Re: [Add] [EXTERNAL] Re: Malware adopting DoH

[Andrew Campling <[e-mail]>]

On Mon, 12 Sep 2019, 12:25 Dixon, Hugh <[e-mail]>  wrote:

While tis true that there have always been other methods than Do53 for Malware C&C and exfil, the thing is that the existence of DoH services from Google (and other very large-scale internet entities) is (IMHO) quite a distinct change in the availability of
*the combination of* :
Conventionally-encrypted (as opposed to stick-out-like-a-sore-thumb custom/obscure)
Unauthenticated but via “public” infrastructure
Globally anycast-by-design (i.e. not trivially IP-detected-and-blocked like static IPs)
A wide spread of steady-flow “genuine” traffic (e.g. 24h peak-to-mean of ~ 2 for example for DNS) in which to hide

And possibly other things.

That doesn’t mean DoH isn’t a good thing as a DNS-on-the-wire-privacy and recursor-authentication protocol (as of course all these features are also what make it a great protocol for attempting to prevent downgrade attacks by what The Internet would call bad (network/nation-state) actors).  However, it does beg the question of (all) operators of DoH infrastructure as to whether they are delivering “a better internet” if they ignore the assistance to criminals that they offer if they don’t actively take a role against them.
Of course there’s an argument that a crook-enabling DoH server is better than an NXDOMAIN-hacking ISP DNS. And a lot of ISPs don’t do any actively-bad stuff with DNS data/responses but do apply malware mitigation.

To address the question, perhaps the “what can we do about mitigating the opportunities for harm generated through innovation?” is the better end point?
H

I agree with the closing comment that the “opportunities for harm generated through” DoH needs to be addressed, starting with information sharing on those harms as they are identified.  Is anyone aware of other examples to add to the one that prompted this thread?

In terms of getting better information sharing, I wonder whether the proposed SMART research group could help here (see https://github.com/smart-rg/drafts for more information)?


Andrew