Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

[Alec Muffett <[e-mail]>]

On Wed, 17 Jul 2019, 19:25 Evan Hunt, <[e-mail]> wrote:

> On the other hand there are millions of parents, so the strict utilitarian
> analysis might not be so clear-cut.
>

That's true, fair point.

Would you care to run some numbers, or shall I?


But I'm not sure why we get hung up on parental filtering per se.  My
> worries are about botnet C&C and data exfiltration, and that's an issue
> that applies to every network, with or without kids, and probably more to
> businesses and governments than to families.
>

That's okay; the botnets are all innovating in the network space and will
gradually bother less with / be impeded by, with censorable men in the
middle such as DNS.

The new hotness in malware C2 is rendezvous communications over existing[1]
social network channels, such as pop-star Instagram comments — not to
mention old workhorses like Tor, or even raw (horrors!) IP addresses.

Albeit there _have_ been some botnets which have been stopped by _creating_
a domain name, and then reinvigorated[2] when that domain name was blocked.

This is not an absolute statement; I freely admit that some malware C2 will
be stopped by DNS filters; but it is increasingly less relevant because DNS
bypass for C2 is a profitable evolutionary niche; so it is human beings who
will benefit from - or will suffer - DNS filters most of all.

[1]
https://www.businessinsider.com/russian-hackers-turla-communicate-malware-britney-spears-instagram-comment-2017-6

[2]
https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack

Glossary: C2 = "command and control"