The Challenges of DNS Over HTTPS (DoH)

Understanding DNS Over HTTPS (DoH): A Quick Recap

Okay, let's dive into dns over https (doh). Ever wonder how your browser knows where to take you when you type in a website address? It's all thanks to dns, but there's a catch...

Traditional dns, that's the old-school domain name system, sends your requests in plain text. (Domain Name System - Wikipedia) This is not good, because it's like shouting your browsing history across the internet for anyone to hear.

• That lack of encryption? It's a privacy nightmare, like leaving your diary open on a park bench. (“SlimeMoldCrypt” is a pre-diploma by Stephanie Rentschler ...) Anyone snooping on your network—ISPs, governments, or even hackers—can see what websites you're visiting.

• Doh steps in, encrypting those dns queries using https – the same security that protects your credit card info when you shop online. It's like whispering a secret message instead of shouting.

• The goal? Stop eavesdropping and manipulation. As indusface notes, this added layer makes it harder for attackers to intercept or mess with your data.

So, how does this magic trick work?

• Doh sends your dns queries over https on port 443. This makes your dns traffic look just like regular web traffic. It's like hiding in plain sight; hard to pick out from the crowd.

• Because it's encrypted, it's much harder to intercept and monitor those dns requests. Think of it as sending your request in a sealed envelope, not a postcard.

• This prevents easy interception and monitoring, but it also requires more processing power. This is because the encryption and decryption process for each query adds computational overhead. For devices with limited processing capabilities or in high-traffic network environments, this could potentially lead to slightly slower response times or increased battery drain on mobile devices.

Now, while doh brings some serious privacy wins, it also introduces a few complexities. We'll get into the challenges that come with it next.

Challenge 1: The Potential for Misuse by Malicious Actors

Okay, so you've got this fancy new encryption for dns, right? Seems like a win for privacy... until the bad guys show up. Turns out, hiding in plain sight works for them too, go figure.

Here's the thing: Doh encrypts dns traffic. That can hide some pretty nasty stuff. Like:

• Malware communication: Think of malware phoning home to its command-and-control (c2) server. Doh can cloak this, making it harder to spot. It's like the malware put on an invisibility cloak.

• Bypassing security: Traditional security solutions often inspect dns traffic. With doh, they're blind, you know? It's like trying to catch a fish in the dark; good luck with that.

• Less effective security: Security solutions become less effective at detecting threats. So, the solutions relying on dns traffic inspection become less effective.

It's not just theory, either. Threat actors have already started using doh to their advantage. For instance, the APT34 group famously used the DNSExfiltrator2 tool to exfiltrate data. This tool leveraged doh to tunnel data out of victim networks, making it appear as legitimate encrypted dns traffic, thus evading traditional network security controls. They are sneaky, these guys.

So, what's a security team to do? It makes threat hunting more difficult because, well, lack of visibility. Incident responders are gonna need to level up their skills to deal with encrypted dns traffic.

Challenge 2: Centralization of DNS Traffic and Privacy Concerns

Okay, so doh is supposed to be all about privacy, right? But what if it kinda... backfires? Turns out, encrypting your dns traffic doesn't automatically make you invisible, go figure.

Here's the deal:

• Reliance on a few doh providers gives them a ton of power. I mean, think about it – they're seeing a massive amount of internet traffic data. It's like handing your browsing history to a select few companies.

• This naturally raises concerns about data logging, storage, and potential misuse. What's stopping them from selling your data or using it for targeted advertising? We're just trusting they won't be evil, basically.

• Users might unknowingly trust these providers with their browsing history, and that trust could be misplaced. I mean, do you really know what your doh provider is doing with your data? Probably not.

Imagine a small town where everyone whispers their secrets to just three people. Those three people suddenly know everything about everyone. That's basically what's happening with doh centralization.

Challenge 3: Compatibility Issues and Network Management Complexity

Compatibility issues? Network management headaches? Yeah, doh can cause a few headaches, not gonna lie. It's not always a smooth ride integrating this stuff, trust me.

Here’s the thing:

• Existing infrastructure ain't always doh-ready. Some older DNS servers and routers just don't play nice. It's like trying to fit a square peg in a round hole, you know? So, compatibility is definitely something you gotta keep in mind.

• Enterprises? They like control. So, relying on some third-party dns service? That can be a tough sell. I mean, they’re used to running the show, not handing it over to someone else.

• Filtering systems get bypassed. Traditional dns filtering? Yeah, doh can just waltz right past 'em. Because doh uses port 443 and standard https traffic, which is typically allowed through firewalls to enable web browsing, it can easily bypass traditional dns filtering mechanisms that might be configured to block or monitor traffic on other ports. It's like having a security system with a secret back door, which is not ideal.

Implementing doh can really complicate things for network admins, tbh. It's not always plug-and-play, unfortunately.

• Configurations get messy. Implementing doh? Can complicate network configurations, especially for larger orgs. It's like untangling a ball of yarn – frustrating, to say the least.

• Control? What control? You might lose control over dns queries within your network. Suddenly, you're not seeing what's going where.

• Policy enforcement becomes tricky. Blocking harmful websites? Enforcing company policies? It gets way harder, trust me. It's like trying to herd cats, but with internet traffic.

Speaking of security, things don't exactly get easier when it comes to network monitoring. We'll get into those challenges next.

Challenge 4: Performance Concerns and Latency

Okay, so, does Doh make things slower? Kinda ironic, right? Security and speed are usually the goal, but sometimes you gotta pick your battles, it seems.

• HTTPS connections adds latency. Doh needs to set up a secure connection, which takes time. This is just a fact. It's like waiting in line at the bank versus just walking in, you know?
• Distance matters, like, a lot. If the doh server is far away, or your network's kinda janky, performance will suffer. Think of it like ordering pizza – the further it has to travel, the colder it gets.
• Slower load times are a drag. Poor connections really feel it. It's not the end of the world, but no one wants to wait an extra few seconds for every page.

While doh often introduces latency due to the overhead of establishing HTTPS connections, there are scenarios where it can actually be faster than traditional dns.

• Optimized servers can be speedy. If a doh server is well-tuned, it can beat traditional dns. It's like having a souped-up engine versus a rusty old one.
• Location, location, location. It all boils down to server location and network conditions, honestly.

I mean, it's something to think about, right? Next up, let's dive into how we can actually make doh faster.

Mitigating the Challenges: Best Practices and Solutions

Okay, so you're dealing with doh... and it's kinda like adding a new lane to a highway, right? Sounds good in theory, but you gotta manage the traffic flow.

One way to control doh in your org is by setting up enterprise policies. I mean, it's like setting the rules of the road for your network, you know?

• Use group policies to wrangle doh on those controlled endpoints. It's like putting a governor on a car so it can't go too fast.
• Blocking doh providers? Yeah, that's an option to keep control over your dns traffic. Think of it as closing off-ramps to keep traffic on the main route.
• And, of course, make sure everything jives with the company's security policies. It's like making sure everyone's following the same traffic laws.

Don't forget about those dns security solutions! They can be your best friend in this situation.

• Employ dns firewalls and traffic filtering tools. It's like having a cop on the beat, watching for suspicious activity.
• Pick solutions that play nice with doh for total security. You want a security system that sees everything, not just parts of it.
• And, of course, integrate those threat intelligence feeds to sniff out malicious domains. It's like having a detective on the case, finding the bad guys before they strike.

You can use deep packet inspection techniques to detect anomalies. For example, you can use intrusion detection systems (ids) to identify threats. These tools can look for unusual patterns in the encrypted traffic, such as abnormally large DNS requests or responses, frequent queries to newly registered domains, or traffic patterns that deviate from typical user behavior. By analyzing these anomalies, IDS can help flag potentially malicious activity, like malware attempting to communicate with a command-and-control server or data exfiltration attempts disguised as DNS queries.

All this stuff can feel like a juggling act, right? Next up, we'll talk about a tool to help simplify authentication and boost security.

Conclusion: Navigating the DoH Landscape

So, we've been diving deep into doh, huh? It's like, is it a privacy superhero or a security villain in disguise? Honestly, it's a bit of both, and navigating it isn't always straightforward.

• Doh offers enhanced privacy, but it's not a silver bullet. It's like adding a lock to your front door, but still leaving the windows open, you know? It encrypts your dns queries, but malicious actors can still try to hide their activities within that encrypted traffic. For example, they might use doh to tunnel malware command-and-control traffic or exfiltrate sensitive data, making it harder for security teams to detect.

• Organizations must be proactive and adopt best practices. Don't just set it and forget it! Things are always evolving, so you need to monitor your network, implement enterprise policies, and use dns security solutions to stay ahead of potential threats like the APT34 group that used DNSExfiltrator2 tool to exfiltrate data, as mentioned earlier.

• Staying informed and proactive is key. Keep up with the latest research, guidelines from organizations like the NSA (for example, their guidance on secure network configurations often touches on encrypted traffic analysis), and adapt your security strategies accordingly. It's an ongoing process, not a one-time fix, which can be a drag but is absolutely necessary.

Ultimately, balancing privacy and security in the doh landscape requires careful consideration and continuous effort. It's like a tightrope walk, but with the right tools and awareness, we can keep our balance.