3 ms·
> spike in NXDOMAIN DNS responses For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated)
by octoberfranklin 6y ago
> spike in NXDOMAIN DNS responses
For those following at home, these are caused by Domain Generation Algorithms that try a ton of (deterministically generated) top level domains. The attacker need only register one of them, and if the domain gets frozen they can often just register another -- until the generator algorithm is integrated into the registrars' blocking system, which takes time and work.
Personally I'm surprised we don't see more malware using the various DNS replacements that sit on top of Ethereum. They were using Namecoin for a while.
- sterlind 6y agoprobably harder to reliably get to Ethereum than to reliably get to any DNS server. for indiscriminately-targeted ransomware Namecoin etc. would make sense, but DNS is a better choice for internal networks.
- jandrese 6y agoAlso, security conscious companies would flag a connection to Ethereum as suspicious in itself, so your effort to hide yourself could in fact draw more attention.
- octoberfranklin 6y agoI know; it really depends on the kind of network the malware is deployed into. If it's some quant trading group on wall street, or the Treasury department, using EDNS for CNC would be outstanding camoflauge. If it's some single-purpose server farm then yeah, of course, stands out like a sore thumb.
- colejohnson66 6y agoWhat about Tor hidden websites? Or would the fact that the URL is a public key (essentially) prevent deterministic randomness without embedding the private key?