TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

The DNS over HTTPS (DoH) Mess

Kassie Kimball · 2022-02-15 · Read original ↗

ATT&CK techniques detected

4 predictions
T1572Protocol Tunneling
74%
“whilst my privacy is being so thoroughly violated. i am further conflicted in that i have no real assurance that my local isp is not mining my encrypted data either. where do we turn from here? there is another form of dns encryption that has existed for a while known as dns over…”
T1071.004DNS
65%
“. 8. 8. 8 ), your dns server must ask the root name servers to aid in resolving a request. the diagram below shows essentially how your local dns server behaves when looking up www. whitehouse. gov for example. what ’ s the problem? as security professionals, we love good encrypt…”
T1071.004DNS
53%
“to diagnose and see what dns traffic is occurring inside my own network. - running my own internal dns server gives me the ability to configure and run my own domain filtering services which i have had in place for a number of years. if you don ’ t roll your own like me, consider…”
T1090.002External Proxy
31%
“block any unauthorized dns from going direct to servers without using internal dns server. one possible method i use to create the ip set for the doh provider list is to list out the providers by domain name as above, and then perform dns lookups on each on a daily basis to ensur…”

Summary

Joff Thyer // I woke up this Monday morning thinking that it’s about time I spent time looking at my Domain Name Service (DNS) configuration in my network. (This thought […]

The post The DNS over HTTPS (DoH) Mess appeared first on Black Hills Information Security, Inc..