Hacker News Reader

Comment by ttyprintk | Hacker News Reader

ClamAV passes its versioning via DNS. No need to open outbound HTTP.

Wonder if ClamAV might have learnt this trick from malware implementations.

I had set up dnsmasq once and spotted all these weird DNS requests coming out of our network. Turns out some Java installation builder software was using DNS to verify the license status of the software. They would do a lookup something like

$LICENSE_NUMBER.$NAME.$ZIPCODE.example.com

and the reply would indicate the license status.

As a TXT dns entry? Or?

Yes, the domain to query is current.cvd.clamav.net

Cooool.

  $ dig TXT current.cvd.clamav.net

  ...

  ;; QUESTION SECTION:
  ;current.cvd.clamav.net.                IN      TXT

  ;; ANSWER SECTION:
  current.cvd.clamav.net. 972     IN      TXT     "0.103.8:62:26823:1677366000:1:90:49192:334"

Reply on news.ycombinator.com