3 ms·
ClamAV passes its versioning via DNS. No need to open outbound HTTP.
by ttyprintk 4y ago
ClamAV passes its versioning via DNS. No need to open outbound HTTP.
- unixhero 4y agoAs a TXT dns entry? Or?
- ignoramous 4y agoWonder if ClamAV might have learnt this trick from malware implementations.
- criddell 4y agoI had set up dnsmasq once and spotted all these weird DNS requests coming out of our network. Turns out some Java installation builder software was using DNS to verify the license status of the software. They would do a lookup something like $LICENSE_NUMBER.$NAME.$ZIPCODE.example.com and the reply would indicate the license status.