Re: [Add] [EXTERNAL] Re: Malware adopting DoH

[Rob Sayre <[e-mail]>]

On Mon, Sep 16, 2019 at 10:46 AM Dixon, Hugh <Hugh.Dixon=
[e-mail]> wrote:

> Type 2 Malware mitigation is what we’re talking about in this thread –
> post-infection malware operation-prevention largely independent of any
> other specific application.
>
>
>
> Is the “All filtering is bad, mmkay” ethos really so strong that the idea
> of interdicting criminal operations is not an option?
>

I don't think that's the case. Here's a list of DoH servers:
https://github.com/curl/curl/wiki/DNS-over-HTTPS ...They make many
different filtering choices.

However, there is another way to look at this problem, well-summarized by:
https://twitter.com/FiloSottile/status/1170848059493892096

"There's a pattern in resistance to Internet privacy improvements:
organizations that somehow manage their fleet's network but not its
configuration.
I'm not sure what control they thought they had, but it's equivalent to a
network attacker's, so yeah it's going away."

I'm glad ISPs are looking at rolling out DoH/DoT. Sometimes, people claim
that these encrypted queries must be made to whatever address DHCP returns.
I am not sure that makes sense, as dictating an endpoint in the clear can
subvert encryption as well (such as when a home router is compromised).

thanks,
Rob