Subject: [Add] Google's DOH(like) being used for evil already

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jun 2019 02:31:31 -0700

https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

-- 
Wes Hardaker
USC/ISI

---

From: Vladimír Čunát <[email-masked]>
Date: Wed, 12 Jun 2019 12:36:43 +0200

> https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

This is more about what javascript is allowed to do in particular cases,
I believe.  Still, one of the main aims of the DoH RFC is exactly to
support doing DNS directly from javascript (without changing anything on
the browser side).  On JS/web there seems to be a never-ending tug of
war between features and security.

Of course, malicious names might better get filtered as well, after
detection of widespread misuse, but that's not really a long-term
efficient approach.

--Vladimir

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 12 Jun 2019 06:18:42 -0700

> detection of widespread misuse, but that's not really a long-term

Since it's trivial to encode JS in different trivial substitution
ciphers, I doubt this can be easily cleaned and filtered.  (the better
thing would be to ensure data coming in through suspicious paths can't
get into the execution stack)

-- 
Wes Hardaker
USC/ISI

---

From: Vladimír Čunát <[email-masked]>
Date: Wed, 12 Jun 2019 15:22:47 +0200

> get into the execution stack)

By "filtering" here I meant blocking on DNS level - in resolvers and
perhaps also killing delegations that are used by malware (on the
registry side).

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 12 Jun 2019 15:24:30 +0200

On Wed, Jun 12, 2019 at 02:31:31AM -0700,
 Wes Hardaker <[email-masked]> wrote 

>https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

It's not DoH but a Google's proprietary protocol (which is something
that many people miss: in the permissionless environment of the
Internet, anyone can invent and deploy a name resolution protocol).

They could have used any of the many DNS->Web gateways.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 12 Jun 2019 15:25:50 +0200

> https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

Next time there is a phishing somewhere on the Internet, with a
look-alike Web page, I expect reports titled "W3C's HTML and IETF's
HTTP used for bad".

---

From: Michael Richardson <[email-masked]>
Date: Wed, 12 Jun 2019 10:38:44 -0400

> https://myonlinesecurity.co.uk/it-looks-like-another-dns-compromise-hack-happening/

It's just executing untrusted code in MIME, while downloading part of the
payload via google.  It's nothing that didn't occur 25 years ago to mail user
agents that ignored MIME's Security Considerations.

What's new is that it (ab)uses google to transfer the payload.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-