Re: [Add] [EXTERNAL] Re: Malware adopting DoH

["Ralf Weber" <[e-mail]>]

Moin!

On 12 Sep 2019, at 12:03, Ted Lemon wrote:

> A question you might ask is, “how do we know that this malware is 
> using DoH?”  Also, now that it is doing DoH, what new opportunities 
> exist for stopping it?  Is it easier or harder to trick it?
>
> It’s all very well and good to point out that it’s using DoH and 
> that this blocks certain mitigation strategies, but eg if Google can 
> mitigate it centrally we might be better off, not worse off, as a 
> whole.
I disagree. It would be nice if Google would mitigate these threats or 
follow local law when it comes to DNS answers. But having it all go to 
Google would still be centralisation with all the associated problems, 
which IMHO is a bigger problem.

The current name resolution architecture being de centralised with a lot 
of security happening in the edge is far better and we should try to 
keep that architecture and work on encrypting/securing the last missing 
pieces without changing the architecture.

We should also deploy public DoH services in a way that for security 
sensitive environments like enterprises it is possible to block them, so 
that these malware threats can not use them.

So long
-Ralf
—--
Ralf Weber