3 ms·

If you were counting on DNS and SNI monitoring to detect compromised endpoints, you’ve lost anyways, because malware can chose its own dns resolution method and

by akerl_ 7y ago

If you were counting on DNS and SNI monitoring to detect compromised endpoints, you’ve lost anyways, because malware can chose its own dns resolution method and avoid SNI regardless of what the OS or Firefox are set up to do.

tialaramex 7y ago
Even better, Malware can (popular malware doesn't so far as I can see today, but could if other methods stopped working) straight up lie in SNI and in the old TLS 1.2 plaintext Certificate message, and produce plausible yet entirely misleading results in your inspection apparatus. A real client expects the encrypted parts that follow Certificate to match up and should abort if they don't, but malware is under no obligation to do that, and a 3rd party which can't decrypt the rest of the handshake won't know e.g. Malware client: SNI for bigbank.example (knowing bigbank will have been excluded from snooping rules at the target) Malware C&C server: 100% Legitimate Certificate copied from bigbank.example Malware client: Cool, let's continue with encrypted setup (ignores the pretence that this is bigbank.example and now communicates with the C&C server undetected and encrypted knowing the logs will just show "bigbank.example") "Security" products can't protect against this without snooping each and every single transaction, but many will be deployed by ignorant/ well-meaning people who don't understand how this works and thus that the products can't actually do what they appear to offer to do.
throw0101a 7y ago
> ... because malware can chose its own dns resolution method ... Except before DoH I could monitor DNS: with plain DNS ("Do53") it is completely visible, and with DoT it is on a different port so it can be filtered. Which is Paul Vixie's point: DoH takes control away from network owners, like me and my home Asus, and me and work.
- akerl_ 7y ago
  Yes, but the malware isn't required to use port 53 or "plain DNS" at all... Regardless of what the OS or Firefox or whatever existing app uses, a malicious binary could just use DoH, or just make an HTTP request directly to an IP, or skip HTTP/DNS entirely and fling data out over UDP to an external IP. Put another way: if your issue is that DoH removes your ability to catch DNS requests from malware, your issue isn't with users enabling DoH, or with app devs defaulting their apps to DoH, your issue is with the concept of non-DNS network protocols. Even if DoH was never standardized, an attacker isn't required to make lookups on port 53 as you desire.

by akerl_ 7y ago

tialaramex 7y ago

Even better, Malware can (popular malware doesn't so far as I can see today, but could if other methods stopped working) straight up lie in SNI and in the old TLS 1.2 plaintext Certificate message, and produce plausible yet entirely misleading results in your inspection apparatus. A real client expects the encrypted parts that follow Certificate to match up and should abort if they don't, but malware is under no obligation to do that, and a 3rd party which can't decrypt the rest of the handshake won't know e.g. Malware client: SNI for bigbank.example (knowing bigbank will have been excluded from snooping rules at the target) Malware C&C server: 100% Legitimate Certificate copied from bigbank.example Malware client: Cool, let's continue with encrypted setup (ignores the pretence that this is bigbank.example and now communicates with the C&C server undetected and encrypted knowing the logs will just show "bigbank.example") "Security" products can't protect against this without snooping each and every single transaction, but many will be deployed by ignorant/ well-meaning people who don't understand how this works and thus that the products can't actually do what they appear to offer to do.

throw0101a 7y ago

> ... because malware can chose its own dns resolution method ... Except before DoH I could monitor DNS: with plain DNS ("Do53") it is completely visible, and with DoT it is on a different port so it can be filtered. Which is Paul Vixie's point: DoH takes control away from network owners, like me and my home Asus, and me and work.

akerl_ 7y ago
Yes, but the malware isn't required to use port 53 or "plain DNS" at all... Regardless of what the OS or Firefox or whatever existing app uses, a malicious binary could just use DoH, or just make an HTTP request directly to an IP, or skip HTTP/DNS entirely and fling data out over UDP to an external IP. Put another way: if your issue is that DoH removes your ability to catch DNS requests from malware, your issue isn't with users enabling DoH, or with app devs defaulting their apps to DoH, your issue is with the concept of non-DNS network protocols. Even if DoH was never standardized, an attacker isn't required to make lookups on port 53 as you desire.