Hello, welcome to the Tuesday, October 24th, 2017 edition of the San Antonio Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Berlin, Germany.

And if you happen to be in Berlin as well this week, Thursday evening I'll be giving a presentation here about the Internet Storm Center and how we

track some of the Internet of Things exploits. Just drop me a note if you're interested in attending.

You can use the Internet Storm Center's contact page or just drop me an email. Today we got a guest diary by Alan too. He's writing about

SOX proxies. First of all, he lists a couple of sites that list SOX proxies that may be interesting

intelligence in order to figure out where some of the attacks that you are seeing coming from.

And he also made some interesting observations how these proxies appear to be focusing on a couple

different networks that apparently, which appear to attract a particular large amount of

these types of services.

And a common problem for networks these days is the ever-increasing

amount of encrypted traffic. Now, this isn't always a security issue necessarily.

Encryption does help protect the privacy of traffic and does protect the integrity in many cases.

But if you're trying to inspect traffic for data infiltration,

or if you're trying to uncover matter command control channels,

it's often quite useful to be able to gain some information about what traffic is exchanged and in particular what

sites people connect to. Now my usual recommendation is that you take a close look at DNS traffic,

but this may no longer really be an option. There is an increasing effort to encrypt DNS traffic. We have DNSSEC,

but DNSSEC really only deals with the authenticity and integrity of DNS messages. It doesn't

encrypt them. The one standard that's gaining a little bit steam here is DNS over TLS.

And it looks like Android is now adding this to its implementation of DNS.

There have been some recent commits to the Android code based

that a couple of Android blogs noticed that do implement DNS over TLS.

...