3 ms·

That is a good thing. No need to take down a malicious domain name, just like malware, add it to a blacklist (Google's Chrome already does this).

sp332 12y ago
The whole point of DNS is that we don't have to pass lists of domain names around, like we did before DNS.
- itistoday2 12y ago
  Erm, one is a lookup table for arbitrary (and unknown) names, the other is a blacklist. These are two very different things (the latter is perfectly practical and manageable).
  - sp332 12y ago
    But why wouldn't a blacklist of people trying to game the system be unmanageably huge?
    - itistoday2 12y ago
      It could be "unmanageably huge" for clients, just like the blockchain itself is unmanageably huge for clients. This is the reason DNSChain is designed the way it is (having a personal, dedicated server to store the blockchain for "groups of friends"), thus allowing many client devices to send it arbitrary queries.
    - AnthonyMouse 12y ago
      > But why wouldn't a blacklist of people trying to game the system be unmanageably huge? First, you don't have to leave every entry on the list until the end of time. At some point (possibly as a result of the domain being on the blacklist) the attacker is going to discontinue using it and it could then be removed. Second, you don't have to store the blacklist on every client device. You could even just integrate it with the DNS. If you want to know if foo.com is on the blacklist, you do a lookup for foo.com.blacklist.google.com and if that resolves then it's blacklisted. If you don't trust Google to maintain the blacklist then you change a setting and your computer looks up foo.com.blacklist.microsoft.com or foo.com.blacklist.spamhaus.org or whatever else instead. The point is to decentralize the decision of who maintains the blacklist, so that users can stop using a blacklist if its maintainer makes unpopular decisions.
    - DavidJRobertson 12y ago
      Perfect use case for a Bloom filter.
jdong 12y ago
No need for a blacklist either, I don't believe there's been a single example of a malware using a purely DNS based C&C (e.g by utilizing TXT records) instead of using DNS to get the IP address for the C&C server. Of course there's always an exception, in this case there exists DNS beacons included in pentesting suite Cobalt Strike, but that doesn't seem to be something widely used.

sp332 12y ago

The whole point of DNS is that we don't have to pass lists of domain names around, like we did before DNS.

itistoday2 12y ago
Erm, one is a lookup table for arbitrary (and unknown) names, the other is a blacklist. These are two very different things (the latter is perfectly practical and manageable).
- sp332 12y ago
  But why wouldn't a blacklist of people trying to game the system be unmanageably huge?
  - itistoday2 12y ago
    It could be "unmanageably huge" for clients, just like the blockchain itself is unmanageably huge for clients. This is the reason DNSChain is designed the way it is (having a personal, dedicated server to store the blockchain for "groups of friends"), thus allowing many client devices to send it arbitrary queries.
  - AnthonyMouse 12y ago
    > But why wouldn't a blacklist of people trying to game the system be unmanageably huge? First, you don't have to leave every entry on the list until the end of time. At some point (possibly as a result of the domain being on the blacklist) the attacker is going to discontinue using it and it could then be removed. Second, you don't have to store the blacklist on every client device. You could even just integrate it with the DNS. If you want to know if foo.com is on the blacklist, you do a lookup for foo.com.blacklist.google.com and if that resolves then it's blacklisted. If you don't trust Google to maintain the blacklist then you change a setting and your computer looks up foo.com.blacklist.microsoft.com or foo.com.blacklist.spamhaus.org or whatever else instead. The point is to decentralize the decision of who maintains the blacklist, so that users can stop using a blacklist if its maintainer makes unpopular decisions.
  - DavidJRobertson 12y ago
    Perfect use case for a Bloom filter.

jdong 12y ago

No need for a blacklist either, I don't believe there's been a single example of a malware using a purely DNS based C&C (e.g by utilizing TXT records) instead of using DNS to get the IP address for the C&C server. Of course there's always an exception, in this case there exists DNS beacons included in pentesting suite Cobalt Strike, but that doesn't seem to be something widely used.