Subject: [Add] DoH and Malware

From: Andrew Campling <[email-masked]>
Date: Mon, 23 Sep 2019 18:31:02 +0000

Steve Miller (@stvemillertime) put out some interesting comments via Twitter last week on DoH and Malware that may be useful to some on here - here's some of the notable posts:

<https://twitter.com/stvemillertime>
            Steve Miller @stvemillertime
            DNS-over-HTTPS (#DoH<https://twitter.com/hashtag/DoH?src=hashtag_click>): currently 40+ public DoH servers (github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers...<https://t.co/V39mnwSAby?amp=1>) and quite a few POCs/tools for using DoH. I know of two named malware families, a couple of likely malware tests using DoH. Why haven't more malware developers adopted it?
            9:12 PM * Sep 18, 2019*Twitter Web App<https://help.twitter.com/using-twitter/how-to-tweet>

<https://twitter.com/stvemillertime>
            Steve Miller @stvemillertime
            There are technical implications for using #DoH<https://twitter.com/hashtag/DoH?src=hashtag_click> for FULL DNS C2, so I understand why this may not be a great route. But are there hurdles to using DoH for simple DNS resolution in malware?
            9:27 PM * Sep 18, 2019*Twitter Web App<https://help.twitter.com/using-twitter/how-to-tweet>
<https://twitter.com/stvemillertime>
<https://twitter.com/r0wdy_>
            The Cyber@r0wdy_ Replying to @stvemillertime<https://twitter.com/stvemillertime>
            Have you posted about the families using it, or still under wraps?
            9:17 PM * Sep 18, 2019*Twitter Web App<https://help.twitter.com/using-twitter/how-to-tweet>

<https://twitter.com/stvemillertime>
            Steve Miller @stvemillertime Replying to @r0wdy_<https://twitter.com/r0wdy_>
            Afaik public ones are GODLUA (blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/...<https://t.co/Vk23Xe2y23?amp=1>) and PSIXBOT (proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module...<https://t.co/lxFViiZFbG?amp=1>)...Outside of that I've only seen what I think are "tests" of things but not really fully formed mal fams. We've seen some evidence of other activity but unfortunately didn't get bytes...
            9:20 PM * Sep 18, 2019*Twitter Web App<https://help.twitter.com/using-twitter/how-to-tweet>

Andrew

Regards

Andrew Campling  MBA  MSc  DipM  FRSA  MCIM  MIoD  Liveryman
Director | 419 Consulting Ltd | Tel: +44 (0) 7710 303010 | E: [email-masked]<mailto:[email-masked]>| t: @Andrew_Campling

This email contains information from 419 Consulting Ltd that might be privileged or confidential. And it's only meant for the person above. If that's not you, we're sorry - we must have sent it to you by mistake. Please email us to let us know, and don't copy or forward it to anyone else. Thanks.

We monitor our email systems and may record all our emails.
419 Consulting Ltd
Registered in England: No 11944258