Hacker News Reader

Comment by throw0101a | Hacker News Reader

> DoH mixes DNS traffic in with the noise of HTTPS traffic, allowing me to run my own DoH resolvers and bypass their restrictions.

And when malware gets on your network and starts using DoH to get around your home resolvers, what will you do?

* https://www.zdnet.com/article/first-ever-malware-strain-spot...

* https://www.zdnet.com/article/psixbot-malware-upgraded-with-...

As someone who works in IT, this is my problem with DoH.

View on HN

That was already a possibility even before all of this DoH publicity. Mozilla, etc. pushing DoH publicizes it's availability, but there was nothing in the past preventing malware from tunneling all sorts of traffic over HTTPS. DNS inspection isn't an end all, be all for malware security. It just gets the low hanging fruit.

There was a lot of low-hanging fruit given that most malware writers aren't going to set up all of this infrastructure for custom protocols.

And even when they did, creating various C&C servers, the lack of ESNI would allow for detecting activity once the daily domain creation algorithm was reverse-engineered:

* https://blog.malwarebytes.com/security-world/2016/12/explain...

Honestly, I don't see why people keep bringing this up. Malware has millions of ways of creating covert channels and you will never be able to block/detect all of them. It's also well within the capability of major DoH server operators to detect and shut down malware domains pretty fast.

This is possible regardless of whether Chrome/Firefox/etc deploy DoH support. In fact, it was possible before DoH at all: nothing mandated that malware use standard DNS requests on port 53.

> ... nothing mandated that malware use standard DNS requests on port 53.

Except using other ports would cause network monitoring software to throw red flags because of the "strange" traffic on non-standard ports.

Nothing requires malware to pick a “strange” port. It could just shove its data into ICMP, or make it look like an SSH connection on 22, or anything else.

Reply on news.ycombinator.com