3 ms·
This is possible regardless of whether Chrome/Firefox/etc deploy DoH support. In fact, it was possible before DoH at all: nothing mandated that malware use stan
by akerl_ 7y ago
This is possible regardless of whether Chrome/Firefox/etc deploy DoH support. In fact, it was possible before DoH at all: nothing mandated that malware use standard DNS requests on port 53.
- throw0101a 7y ago> ... nothing mandated that malware use standard DNS requests on port 53. Except using other ports would cause network monitoring software to throw red flags because of the "strange" traffic on non-standard ports.
- akerl_ 7y agoNothing requires malware to pick a “strange” port. It could just shove its data into ICMP, or make it look like an SSH connection on 22, or anything else.