NSA Recommends How Enterprises Can Securely Adopt Encrypted DNS

The tricky bit is that offense and defense actually require the same knowledge. A 0-day is immediately applicable for offense and must be immediately patched for defense.

Yes, I stipulated that in my post. However, we have seen how the NSA wants data from US corporations. If they make a "recommendation" for corps to use, then how do we know it is solely for the corporation's best interests rather than the NSA's own interests in more easily accessing the corp's data while providing false sense of security?

We do know that the NSA pushed for a particular type of RSA encryption to become the default because they already knew how to break the encryption. Once something like that is known in the wild, credibility will from then on be suspect at best as to true motive.

Only if it doesn't make their own work any harder. NSA prefer weak security for everyone if securing US assets might risk others to be more secure too:

>NIST failed to exercise independent judgment but instead deferred extensively to NSA. After DUAL_EC was proposed, two major red flags emerged. Either one should have caused NIST to remove DUAL_EC from the standard, but in both cases NIST deferred to NSA requests to keep DUAL_EC"

https://www.nist.gov/system/files/documents/2017/05/09/VCAT-... [PDF warning]

Prosecution of government employees and officeholders. You don't gain trust without a reason to trust you. There is no magic reset button. After COINTELPRO and Iran/Contra and Snowden, the USA Intel establishment has a solid record of attacking their own citizens and behaving as though laws don't apply to them and there is no oversight. Valerie Plame?

And then there's the last five years, starting with the Clinton email server. The Intel community can't prevent that, and then the FBI goes political at the end of election season?

There is no trust of intelligence agencies because they have proven they deserve none.

Your successes are secret, your failures are known. That's your industry's catch phrase.

Here's a list of things I can think of:

1. If you're the CIA/NSA, stop spying on American citizens.

2. See #1

3. Stop NSLs. If you want data, get a valid warrant visible to the public. Allow companies to inform their users/customers that their entire platform is vulnerable.

4. Subject yourself to non-govt over view.

5. Stop hoarding 0-days, and actively work with vendors to fix vulns.

Don't know how to fix it, but until you're no longer in the news for screwing up, this is where we are. Your internal documents show that all of that data slurping has not led to significant positive results. Why spend the money on it then? Why erode the trust that you want? You don't want to tip off the advesary, but your own citizen's rights are much more valuable than what little information you are getting.

In addition to what others have already said, actually preventing major breaches like the recent Solarwinds hack. Eg, besides the tinfoil hat stuff, just getting the basics right.

Personally I'd like to see the entire US govt IT infrastructure rebuilt around DARPA's HACMS project [1]. Get rid of Windows, base it all on SEL4 Linux or similar, rebuild the apps (everything in userspace), etc. That would significantly reduce the attack surface. Huge project obviously, but one can wish.

[1]:https://www.darpa.mil/program/high-assurance-cyber-military-...

For odd family reasons I have a lot of acquantances in SOCOM and intelligence orgs, and I've been around these sorts of people long enough to know that the vast majority of them are well meaning and sincerely eager to do the right thing. But see, that's the problem: they're all employees, and they all report up the chain to an unelected appointee, far removed from any voting-based accountability.

I don't think the trust will ever come back because I don't believe the government has the right incentives in place to restore trust. It only gets worse from here. And certainly nothing I've learned about them in the last 10 years would convince me otherwise.

Strict civilian oversight, transparency, protections for whistleblowers, and culling much of the current leadership

A free Snowden would be a good start

James Clapper is still a free man despite lying to Congress and the American public, so I don't see why anyone should trust a word anyone says from any US intelligence agency.

It is the nature of trust that it is easily lost and difficult to regain. Basically trust is based on experience over the long term. If there are good experiences for a long time trust grows. Any breach of trust resets the trust clock to zero (or even to a negative value).

Host all their secrets and vulnerabilities on their site and shut down everything else. Prosecute everyone involved. Follow Nuremberg principles set by the US itself (IE. "I followed orders" is not an excuse.)

A number of years of good behavior.

The numbers going to be a bit different for everyone, but as the years go on trust will be built with a larger and larger portion of the public.

Decades of transparency and trustworthiness.

Put Edward Snowden in charge of NSA.

I know that sounds ridiculous, but you asked.

Human civilization has a long history of people who were exiled for their priciples returning as great leaders. It's a hard-to-fake signal.

I can see the logic in your theory. Further testing would be required for validation though. I would almost expect the public recommendations for corporations to be different than a company like a defense contractor.

At the end of the day, it's ther own damn fault that their recommendations are viewed so skeptically.

> they defend the home front as well

No they clearly do not, not if it makes it any harder for themselves. They include weaknesses and backdoors in products and encryption used by US companies too. That is the direct opposite of "defending the home front".

That's far from a red herring. Lawful intercept features have been hacked before, and NSA tools have been leaked before.

Apart from that, do you really want your infra to be someone's pawn on a virtual battlefield? Nothing they do is going to be in your direct interest.

Apart from that, there is parallel construction and rapidly shifting social/political winds that can turn inoccuous one day into verboten the next.

It's clearly also spurred by the attempts to further obfuscate the use of DoH via Oblivious DoH [0] - though they don't go into much details on it.

[0] https://news.ycombinator.com/item?id=25344358

>thus bypassing the enterprise's ability

I think you could change it to read " bypassing the NSA's ability" and find the real reason behind this.

In other words "MitM everything".

It gets so tiresome. I used to think the people who called out tyranny everywhere were just nuts, but it never ceases to amaze that everything nowadays keeps going "centralize and control".

It is going to be super hard to block DoH since it is indistinguishable from normal HTTPS traffic. If you MITM the HTTPS connection the browser can detect that and refuse to use the connection. Many companies are in this situation that MITMing HTTPS is not working very well. I think Google enforces HSTS[1]. Not sure how that works with DOH. I also think that we need browsers that do not have any other means of DNS resolution than the good old operating system wide /etc/resolv.conf (or similar). I am not going to fight with Google if I have the right to have my own DNS server or not. They are taking the open internet inch by inch. This is the last drop.

1. https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Exactly right. Many security problems are due to forgoing the simple things in favor of exotic.

They are high quality services, not controlled by the company.

It’s pretty obvious that allowing unloggable DNS traffic in an enterprise is a bad idea. It makes ex filtration trivial.

>Because "more security" is hard to argue against. The huge corporations who ultimately want to take control of the population have realised that, and are using that excuse to get in bit by bit.

But in reality, DoH doesn't really provide "more security."

All it does is obfuscate DNS queries. If you're concerned about ISP tracking, DoH doesn't really help with that at all since the ISP can see where you're going just by looking at packet headers anyway.

And the Googles and Facebooks of the world love DoH because it bypasses PiHole style ad/tracking blockers.

The appropriate solution is to use PiHole (or PiHole style blocklists) in concert with a local recursive resolver (or an external resolver that supports DNS-Crypt), not to obfuscate your DNS requests, allowing all the ads/tracking/spying connections to proliferate.

It's not a perfect solution, but it's a much better solution than needing to implement one or more ad/tracker blocking solutions on every single device on your network.

How will DoH help "huge corporations... take control of the population"?

An estimated 18,000 companies were affected by the SolarWinds incident. Many of those companies had excellent inventory, logging and configuration control. You simply cannot detect DNS over HTTPS in the network without performing MITM.

No. My point isn't to use security on top of existing DNS records. My point is to make a brand new distributed system entirely that is free for all instead of run by a bunch of greedy internet thugs.