3 ms·

GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. For non-tech companies, replace

by akerl_ 6y ago

GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. For non-tech companies, replace with any relatively popular wiki. The goal is “make a connection over HTTPS or other normal-looking protocol, to a destination that is both justifiability relevant for normal user traffic and allows the attacker to seed the next-step”. And it turns out there are lots of sites that fit that bill.

lmm 6y ago
> GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. They're not going to leave malware payloads sitting there. Pastebins etc. get abused as malware command-and-control systems all the time, and of course some gets through, but countermeasures happen. Whereas for a DoH server it would be operating as designed.
- shawnz 6y ago
  Domains can be seized too, nothing is foolproof.
- bilkow 6y ago
  > They're not going to leave malware payloads sitting there. They do though, I usually check where spam emails lead me to as a curiosity, and the payload is sometimes hosted on github. A simple GET request to https://github.com/adkafdjsh20/cool_repo/blob/master/dns.txt https://github.com/adkafdjsh20/cool_repo/blob/master/dns.txt would work for DNS purposes. Also, there are countermeasures for malware domains themselves, as you can report them to registrars.
- akerl_ 6y ago
  As a parallel reply noted, the goal isn’t to host a payload on GitHub or a pastebin. The issue is “how do I tell my bootstrapper where to get a payload from in an inconspicuous way”. To solve that, you find a benign site with existing business purpose (like GitHub or a wiki or a pastebin), and you insert your desired IP address. So maybe you add it as new file in a repo under your cool new fake GitHub account, and the file just says “1.2.3.4”. Now you can tell your bootstrapper to make an HTTPS request for that file, which looks boring to any introspection because outbound requests to GitHub are normal, and to use the resulting IP to request the payload. Your compromised payload host gets shut down? Spin up a new one, and update the file on GitHub with the new IP.

by akerl_ 6y ago

lmm 6y ago

> GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. They're not going to leave malware payloads sitting there. Pastebins etc. get abused as malware command-and-control systems all the time, and of course some gets through, but countermeasures happen. Whereas for a DoH server it would be operating as designed.

shawnz 6y ago
Domains can be seized too, nothing is foolproof.
bilkow 6y ago
> They're not going to leave malware payloads sitting there. They do though, I usually check where spam emails lead me to as a curiosity, and the payload is sometimes hosted on github. A simple GET request to https://github.com/adkafdjsh20/cool_repo/blob/master/dns.txt https://github.com/adkafdjsh20/cool_repo/blob/master/dns.txt would work for DNS purposes. Also, there are countermeasures for malware domains themselves, as you can report them to registrars.
akerl_ 6y ago
As a parallel reply noted, the goal isn’t to host a payload on GitHub or a pastebin. The issue is “how do I tell my bootstrapper where to get a payload from in an inconspicuous way”. To solve that, you find a benign site with existing business purpose (like GitHub or a wiki or a pastebin), and you insert your desired IP address. So maybe you add it as new file in a repo under your cool new fake GitHub account, and the file just says “1.2.3.4”. Now you can tell your bootstrapper to make an HTTPS request for that file, which looks boring to any introspection because outbound requests to GitHub are normal, and to use the resulting IP to request the payload. Your compromised payload host gets shut down? Spin up a new one, and update the file on GitHub with the new IP.