9 ms·
> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH n
by ignoramous 6y ago
> I want my OS to do DNS - including DOH, not my browser.
The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions.
Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).
- EastSmith 6y agoCan you elaborate? An adware app will be installed in the OS, and will proxy all DNS requests?
- BostonEnginerd 6y agoApps will make DOH requests from within their apps to avoid host-based DNS blocking.
- pmontra 6y agoThe next step is blocking all the traffic from all apps and whitelist the IP addresses app by app. I did it on my Android phone, a couple of phones ago. I don't remember the name of the app. It could be done on a desktop or server OS too.
- topranks 6y agoThat sounds like a fun way to spend your life.
- franga2000 6y agoThis is nothing that wasn't possible before. Taking the traditional example of hosts-blocking the Adobe activation servers, what was stopping them from just querying 1.1.1.1 from the app? Or even falling back on a hard-coded IP? Especially with IPv6, bypassing DNS-based blocks is rather trivial - the main reson we don't see it all that much is that companies simply don't care to do it. Users of PiHole and similar are usually the kinds of users who will figure out a way to block whatever they want one way or another, so there's no use in trying to stop them. Until we get hardware-enforced app signing (big middle finger to Apple here) we can block anything, regardless of DoH.
- iso1631 6y agoYou're right, I guess the question is did they bother before. If normal DNS works fine for 95% of users, the hurdle of implementing a non-standard workaround is too much. If DOH is the norm, then the hurdle becomes lower. Of course you can just drop a rule blocking the IP address on your firewall, which will probably work for a while.
- shawnz 6y agoI would argue that the hurdle of bypassing DNS-based content blocking was already so vanishingly small that it doesn't make any sense to impede useful and practical privacy technologies on that basis. You could make the exact same kind of argument about widespread use of HTTPS for example. Do we want to allow encryption technology if it means the enemy can use it too? As a society we have agreed that encryption is a net positive even though terrorists and criminals benefit from it, but when malware uses it then that's too far?
- pbhjpbhj 6y ago>I would argue that the hurdle of bypassing DNS-based content blocking was already so vanishingly small [...] // That doesn't hold up under scrutiny. My pihole blocks ~11% of domain lookups (blocking 1000 queries per day for our household), turning it off vastly increases the unwanted content. It might seem is logical a ready hurdle, but it's a hurdle that practically works. I don't follow the reasoning that says this is a small barrier to malware so we'll remove it. What are we, end users, getting out of routing all our domain lookups to Cloudflare and ceding control of filtering?
- deleted 6y ago[deleted]
- iso1631 6y agoI've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic. It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers
- nine_k 6y agoIf only the OS could terminate TLS and allow to filter decrypted traffic locally.
- 2ion 6y ago> The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. But tunnelling X in Y is not new at all and has a long tradition (even in regular protocol design). Is this really a shift waiting to happen in malware? As I would think, this has been available all along. Except for browser-based malware.
- shawnz 6y agoRight. It is ridiculous to say that DoH enables malware because it has always been trivial to bypass DNS-based access control with or without technologies like DoH. In fact, if anything, using DoH would be a particularly cumbersome way of doing it when there are many simpler solutions. Like for example, just putting an IP in a text file on a REST endpoint.
- Spivak 6y agoI think the best case I can make is that it's not about the ability to tunnel DNS, it's that there's now many fast highly-available public DoH resolvers that bypass DNS filtering for free. A hypothetical malware author just needs to use any of them rather than set up their own tunnel.
- shawnz 6y agoTrue, this aspect of the situation could make malware use cases a bit simpler to operate/maintain.
- swiley 6y agoIf we're going to talk about the "right" thing to do then don't run closed software or anything that doesn't do what you want and the problem goes away.
- akerl_ 6y agoThis has always felt like a strange concern to me. It’s a bit like refusing to have gloves in your house, so that a burglar can’t borrow your gloves to avoid leaving fingerprints. Adware, spyware, and malware has always had the ability to avoid system DNS. At its most basic, they could hardcode lists of IPs into their malicious code. At its most complex, the same building blocks that DoH/DoT use were available to them: they could build similar tools that tunnel over HTTPS/SSH/etc, whichever protocol they felt was least conspicuous on their target system. Drop a list of hostnames into a pastebin post, tell your malware to check the list for updates, profit. DoH in Firefox simply makes the above issue harder to ignore. Before this, an enterprise or individual sysadmin could implement DNS inspection at the border, see logs showing their users browsing naughty websites, and feel like they’d made progress. But they’d always be blind to attackers (or nefarious users) who just didn’t bother using the stock DNS offering to bootstrap their hijinks. Detecting that has always required device-level monitoring or further MITM of traffic; learning about DoH makes that more obvious to sysadmins, but it doesn’t materially change what adversaries were able to do already.
- ignoramous 6y agoI am not in disagreement. > DoH in Firefox simply makes the above issue harder to ignore. That's exactly what I mean [0]. The cat's always been there so to speak but now it is out there roaming around harder to ignore. [0] https://news.ycombinator.com/item?id=25123487 https://news.ycombinator.com/item?id=25123487 and https://en.wikipedia.org/wiki/Script_kiddie https://en.wikipedia.org/wiki/Script_kiddie
- zrm 6y ago> At its most basic, they could hardcode lists of IPs into their malicious code. Which makes the malware more fragile, because the hosts are often compromised machines themselves, or are the targets of takedowns. If they include only one IP at a time (as they can do with DNS) then when that machine gets cleaned by the owners, they have no way to switch to another one. If they list several machines then anyone analyzing the malware has a list of multiple compromised machines to go have them all cleaned at once. Also, then you can add the IP address to a block list and they can't update it like they can with DNS. > At its most complex, the same building blocks that DoH/DoT use were available to them: they could build similar tools that tunnel over HTTPS/SSH/etc, whichever protocol they felt was least conspicuous on their target system. Malicious javascript in a browser doesn't have access to SSH or similar. And that's assuming their code can even reach your machine if your Pi-hole is blocking the DNS name of the server hosting it. > DoH in Firefox simply makes the above issue harder to ignore. It makes it harder to prevent. Someone sends the user an email link to a URL containing an unpatched browser exploit or a link to a malicious binary. If the Pi-hole blocks the domain and/or the IP address in the email, the attack is prevented. If the browser bypasses the Pi-hole, you have malicious code actually running on the user's machine, and that's a much bigger problem.
- dheera 6y agoI'm not fully understanding how this works. Can't the user just run their own secure DOH server and tell Firefox to use that instead?
- zelly 6y agoRun your own DNS server locally. It's not that hard.