Hello, welcome to the Monday, January 18th, 2021 edition of the Sandcentred Storm Center's Stormcast. My name is Johannes Ulrich. And I'm recording from Jacksonville, Florida.

This weekend, Guy wrote a diary about some scans that he saw in his honeypots looking for DNS over HTTP endpoints.

So what these scans are looking for are systems that are configured to accept recursive requests

via DNS over HTTP. DNS over HTTP, of course, has sort of caused a big stir these last couple years as browsers,

sort of more and more embraced it as a more privacy-preserving protocol.

The countermeasure often deployed by enterprises is to block access to certain DNS over

HTTP services, like the well-knowns, like, for example, Cloudflare, Google, and the like.

So if an company does block these well-known DNS over HGPS services, an attacker may choose to use, well, a private service that someone put up and they're not really all that

difficult to set up. For traditional DNS servers, we often have attackers scan for resolvers

in order to use them in denial of service attacks. Now, this is not really an issue when it comes

to DNS over HTTP due to the use of

TCP and then of course also TLS. There is little to no chance that they are used for these

amplified reflective attacks that we have seen with traditional DNS recursive servers.

But instead, well, they may use them to evade corporate filtering policies,

and of course could also be used then for attacks or just to anonymize queries.

So how do you block DNS over HTTP if a non-published endpoint is used? Well, in my opinion,

it's actually a much easier question, really. It really comes down to do you intercept a TLS?

If you do intercept TLS, it's pretty straightforward based on the content type to figure out that a certain

HTTP request is a DNS over HTTP request.

And then you can log them, you can block them, or whatever.

If you do not intercept TLS to decrypted, then you pretty much have already lost the battle.

Really, DNS over HTTP is not going to make a big difference.

...