Subject: [Add] Malware C2 non-DNS alternatives

From: "Dixon, Hugh" <[email-masked]>
Date: Wed, 16 Oct 2019 14:11:47 +0000

I am actually quite interested in whether this is true -
I'd say that the requirements are fairly heavy for a really good malware C&C proxy (which is what DNS is doing, right?)

- anonymous/unauthenticated (e.g. not like an AWS instance with a shuttable-down user account and potential traceability)
- globally deployed/available
- with automatically-updated configuration (straight by miscreant action)
- highly-scaled
- traffic type already very very common in all network environments, with 24/7 activity.

Any more?

H

On 09/10/2019, 20:25, "Add on behalf of Dave Lawrence" <[email-masked] on behalf of [email-masked]> wrote:
<snip>
It's
    not because of a lack of possibilities that aren't the DNS.  I'm sure
    a non-trivial number of people on this list could come up with some
    non-DNS methods pretty quickly.
   </snip>

Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD