start	end	text
0	3040	Thank you, Giglio. I appreciate the heads up there.
4640	8100	Well, good evening, good afternoon, good morning, wherever you are.
8820	15660	And welcome back to the DEF CON group's village. I'm here from DC 603, which if your phone code,
15660	22280	phone area code memory is not great, is New Hampshire. And so 603 does, as an MPA,
22280	29180	cover all of New Hampshire. But really, we are located in the Upper Valley. And I'm going to
29180	35640	ask that the speaker assistant here advance the slide to the next slide real quick.
36340	43100	And so we're like halfway up New Hampshire, which makes it far enough away from Boston that we're
43100	48280	not really part of the Boston commuter area, the Boston suburbs that kind of extend into the
48280	54360	southern part of the state. And there's an awful lot of security meetups down in that area and
54360	60980	around Boston generally. So we are actually up in an area that has a lower population density
61820	67580	and definitely a lower tech job density. And if you could advance the slide, that'd be great.
67580	72140	There we go. And let's just go one more part of that, please.
73900	77120	I think that's an interesting red that we've got there on the state.
77720	84200	The wonders about space VR. So just as an aside, I will say that if we make it
84200	92380	through this slide, this talk today, I don't know about Jim Troutman, my compatriot here who I'll
92380	99300	introduce in a second, but certainly from my point of view, I feel like this may be the most
99300	105520	complicated setup we've done for a talk. So I'll feel like I can present on mainline or present
105520	110780	anywhere if I can make it through this one. So thank you for bearing with us as we do this.
110780	123540	And so what you should be seeing on Twitch is that we've got... there we go. That's weird. So
125520	130880	I don't know where the slide is at right now because I see something on Twitch that is...
130880	135220	oh, there we go. I got it. I got it. It just came through on my Twitch. So yeah, so that meeting
135220	142400	room that you see there, that was our last virtual meeting back in March,
142840	148700	and our last physical meeting back in March. And of course, with the lockdown situation, which I
148700	152860	think we'd originally figured would not maybe last quite as long as it has so far, and as it
152860	158120	looks like it's going to, we didn't immediately dive into a virtual mode, although we're kind of
158120	163400	spinning that up more now. But yeah, so we've been getting together in person every month,
163400	169780	and having some talks that are accessible if you're listening to this, and if you're in the
169780	175500	area and you're new, and you're like, well, I'm not a super, super skilled hacker. It doesn't
175500	182160	matter. Come along. I think as long as you've got the interest in the topic and the passion in the
182160	187120	topic, we're going to be delighted to contribute to you and get your contribution and your experience
187120	194800	back and just work as a group to share those experiences and expertise. So in the case of
194800	201640	the talk that we're about to present, this is actually a talk that Jim Foutman has done before,
202240	209320	and he gave the talk originally at ShmooCon as part of the ShmooCon Fire Talk series,
209320	220560	and won the top prize for that this past year at ShmooCon. But when we did it locally in DC603,
220560	227080	what happened there was it provoked an awful lot of conversation, and that's typically how it goes,
227080	231520	right? We're looking to have not just, you know, talk sessions, but we're looking to have
232440	237960	a meetup where it's small enough that we can really dive in and talk about some sort of topics
237960	245820	in some detail. The Twitter that we have is easily, you know, findable. It's DC underscore
245820	253040	603, because I think somebody else has spotted on DC603. But yeah, if you follow us, DC underscore
253040	259460	603, it's a low volume list. We're just sending out when there's particular things to be aware of.
259460	265600	And then we also have a Slack, which if you want to join with us and come to meetings and so forth,
265600	272040	we can get you on Slack. And I think the expectation coming out of this DevCon is,
272040	277140	I think there's going to be some evolution with how we're doing Discord, and I suspect we'll
277560	283800	probably look to do more with Discord going forward. So rather than preempt that, we'll wait
283800	289600	and see how that plays out through Con and after closing, and then, you know, any updates with that
289600	294080	there. So I don't think, with the way this is set up, that I'm going to be able to hear anyone's
294080	300360	questions. If there are questions that you want to try and yell out, go for it or throw it into
300360	304640	the text in Discord, and I'll take a look at that and catch up on that and maybe get back to you at
304640	312120	the end. But without further ado, we have Jim Froutman on the line with us. He is ventriloquizing
312120	318640	through me. So, you know, you're seeing, I think, one disembodied body on stage, but there's actually
318640	323000	two of us in the one body, which is kind of how I feel about Jim. He's an amazing guy.
323000	327080	Some of you probably know he does Sky Talks with me or I do Sky Talks with him.
328640	337160	And he is with us here to dive in on a topic that has been part of his life, I think, for
337800	342080	a hell of a long time. He's been playing around with telecom and DNS and all that stuff
342880	348720	forever. And when he first said to me many months ago, he was going to do a talk on DNS,
348720	355280	I was like, oh, cool, that's a neat 101 talk. And then he did the talk, I'm like, oh, my goodness,
355280	361580	there is so much about this that I've just been oblivious to and not keeping up on the tech. And
361580	367320	there's some really interesting stuff here. So, if you think you know DNS, maybe you do. More
367320	371400	power to you, but I suspect there's a few folks out there that are going to learn something today.
371500	377640	Jim, over to you, man. Hey, good afternoon. Can you guys hear me?
378200	384560	They better. Just keep going. We hope so. All right. Well, if we can take the slide,
384560	392040	if we can take the slide forward to the title slide. Thank you.
392520	400140	So, thank you, guys, for the DC Groups team for setting this up and making all this work. And
400140	406200	I know there's been a lot of technical challenges, but I think it's been a good learning experience
406200	414480	for everybody involved. And thank you to Donald for inviting me to come and do this presentation
414480	430180	today. Okay. So, DNS New World Order. What the fuck? So, I'm a guy on the internet. You can
431120	439960	find me easily. I've been around, done a lot of things in ISP land. I've been on the internet
439960	450520	since 87. I have to issue a disclaimer. I am a director and co-founder of a non-profit internet
450520	457560	exchange called Weenix. We happen to host some servers for one of the companies that I'm going
457560	466840	to be discussing today, Quad9. So, just a little disclaimer. All right. So, here's what we're going
466840	473160	to learn today. Topics of presentation. We're going to talk about the DNS system in general
473160	480860	and some of these new encrypted DNS methods like Doe and Dot. We're going to talk about operational
480860	487100	reasons why you should monitor your DNS, about all these cloud services that are out there
487100	493340	offering easy-to-remember DNS servers and why would they want to do such a thing.
494140	500900	The privacy implications of some of the web browser product decisions. And then I'm going
500900	505660	to end with some recommendations on how to mitigate the impact of all of these new
506300	513170	encryption methods and those cloud-based DNS services.
514890	524090	So, this slide here, which is, talks about the new troubleshooting procedure.
524690	530710	It is not DNS. There's no way it's DNS. It was DNS.
534110	539710	And I'm going to pause here until the slides catch up.
542730	546830	We should be on the one that says new troubleshooting procedure. It's not DNS.
546830	552810	There's no way it's DNS. It was DNS. We know it was always DNS. And if Jim, if you can do a
552810	557330	next every time from now on, hopefully we can keep it that same.
558470	565210	So, we're on the graphic, right guys? New troubleshooting procedure sitting on a cube wall.
565350	568030	There's a little bit of a delay on the screen. I can see that.
568030	572710	Who would have thought? Latency on the internet. Yeah, it's amazing.
575230	580310	All right, are we going to share these slides afterwards, Jim? Yes, yeah. Okay, so if there's
580310	585150	anyone in the audience who's trying to throw bricks at us right now, we will make sure you
585150	589790	get a copy of the slide deck and you can just play it through in your own mind afterwards again.
590430	596930	Yes. Oh, I see it loading. I see your cube wall loading.
601650	606810	It's rendering like line by line on my Twitch. I don't know about yours. Yeah,
606810	611030	I apologize. That's awesome. Apparently, my slides...
616610	620950	They're not even all that complicated. Hey, look, graphics.
620950	627810	Masterized PNGs, right? Yeah. I wonder if it's like upscaling them into some sort of
627810	636310	ludicrously detailed resolution that it doesn't need to. Anyway, I'm proceeding onward. So,
636310	643490	let's talk about DNS. Next slide. So, what the heck is DNS? So, it's the domain name system.
644250	650590	And it is really about the most fundamental technology that makes the internet work
650590	659650	other than packets and wires and fiber. And it works so well that most people never even think
659650	666830	about it. We don't think about it until it breaks. Most end users really have no knowledge about it.
667290	677610	So, what DNS does is that it simply converts the names that humans can remember into numbers,
677610	682650	which is what computers use, network addresses. Next slide, please.
684060	689450	It's also used internally by almost every organization because almost everybody's
689450	696270	running Microsoft Active Directory. And guess what? Active Directory depends entirely
696270	703370	on DNS working correctly and reliably. Next slide, please.
706370	713550	So, really, everything you do on the internet needs DNS to function. This is why a lot of people
713550	719290	will say something like, and I'm sure those of you in the audience that have done any sort of
719290	725390	tech support or help desk, you've heard this before, the internet is down. And usually,
725390	732450	that's not the case. The internet is just fine. But DNS resolution was broken for that user.
733000	741010	So, DNS requests are usually called queries. And next slide, please.
743040	749270	These queries that you issue all the time with your browser and with your phone and pretty much
749270	757890	every single app that you use, they reveal an awful lot about you and what you are doing online.
757890	765350	The games you play, email, et cetera. So, a little refresher about what DNS is.
765350	773330	Next slide, please. Domain names are hierarchical. They start at the root or the dot. And then we
773330	781190	have top-level domains. And there's the original generic top-level domains like .com and .gov and
781190	791750	.net or various country codes like .uk, .jp. Originally, there was just a very few number
791750	799850	of top-level domains. Now there's more than a thousand. You have such things as .bank, .coop,
799850	811160	even .horse, which is kind of fascinating. All right. So, this next slide, please.
815090	826130	So, we have some example DNS names. Google.com, www.bbc.co.uk, et cetera. You get the idea.
826290	833110	Most of you guys know how DNS is structured. So, DNS is a service that converts names into
833110	843310	numbers. So, for example, next slide, please. You look up a record like www.cnn.com when you
843310	850530	punch that into your browser. You'll get an IPv4 address that you can almost remember,
850530	859050	151.101.167. But with IPv6, you're going to get a big, long hexadecimal address that
859050	864570	nobody in the world should try to remember. This is why we have DNS.
865630	879590	Next slide. So, DNS was originally conceived in 1983, roughly. At least the RFC was published
879590	888690	then, RFC 882. And that was superseded by RFC 1035 in 1987. And that is basically more or less
888690	896210	the DNS that we have today. BIND, the Berkeley Internet named
897050	907330	Daemon, was created in 1985. And this DNS is really the last major plain text protocol that's
907330	912890	left on the Internet. Although, as we're going to discuss, there's lots of people trying to
912890	920190	make it go away. A little more background on the DNS. In order for DNS to work,
920190	928190	you have to have the root servers. Next slide, please. The 13 root servers in the world,
928190	935050	lettered A through M. And they're operated by 12 different organizations. And it's important
935050	941810	to understand that these 13 servers that are the root of the DNS, they are by no means
941810	948110	individual servers. These are clusters of servers with load balancers and multiple
948110	955790	instances all over the world. Some of these root servers have over 160 separate physical
955790	962270	instances around the world in various data centers. Because they're so widely distributed,
962670	969590	this allows scaling of traffic volumes and lots of increased resiliency and redundancy,
969590	976410	particularly against directed attacks like DDoS attacks, which root servers get all day long.
976470	984150	Next slide, please. So, all of the root servers in the letters A through M,
984150	990870	they get a massive amount of traffic in terms of queries and transactions.
990870	998190	We're talking double digit billions of queries per day processed by these root servers.
998190	1009090	That's trillions of DNS queries per month. And the DNS has actually managed to scale
1009090	1017810	over nine orders of magnitude in the last 35 years. And it will continue to do so.
1017810	1024570	I think that's pretty impressive for a protocol designed in the mid-80s.
1025290	1032750	One of the ways that DNS scales... next slide, please... is a technique called IP NCASI.
1032750	1037990	This is where you take an IP address block and you advertise it in multiple locations
1037990	1045710	on the internet at the same time via BGP routing. The same address appears in multiple locations
1045710	1054550	and your ISP or your network makes decisions to steer the traffic to the best, nearest instance
1054550	1061770	of that IP address. So, all the DNS servers, all the root DNS and all the cloud DNS in the world
1061770	1072110	uses NCAST. Next slide, please. So, we talked about traditional DNS started in 85. It's what
1072110	1082770	some people are now calling DO-53, since we have DOH and DOT. DO-53 is the original unencrypted DNS.
1083440	1091890	So, it's UDP port 53 for queries, TCP port 53 for zone transfers. And it's, again,
1091890	1098230	it's been largely the same for the last 35 years. Next slide, please.
1098230	1105110	The wonderful thing about DNS from a network management point of view and a security point
1105110	1110970	of view is that it's plain text. So, you can monitor it over the wire very easily.
1111930	1119610	And I have to say, if you're in a corporate environment and your IT security staff isn't
1119610	1127590	monitoring DNS, they're doing it wrong. If you are the IT security staff for your organization
1127590	1137090	and you are not monitoring DNS, you really ought to. It is incredibly useful to monitor DNS,
1137090	1145010	lets you know what your endpoints are up to. It makes it easier to find malware and, of course,
1145010	1157570	good old AUP violations on your network. Next slide, please. So, there is some other,
1157570	1162870	and some people have thought, well, that's kind of a problem. I don't really want people to know
1163410	1171730	what I'm doing and what my DNS queries are. So, there was a group of folks that were not IETF
1171730	1177530	and did not come up with an official standard, but they created a thing out of the free VSD
1177530	1188250	community called DNS Crypt. And I skipped over DNSSEC. You may have heard of DNSSEC.
1188470	1197330	It's a way to cryptographically authenticate DNS data, but it doesn't actually hide it,
1197330	1202710	it just authenticates it. And DNSSEC is really not a topic of this presentation,
1202710	1212850	it's like a whole other presentation unto itself. Okay. Next slide. DNS Crypt, 2011,
1212850	1220690	bunch of folks in the free VSD world were instrumental in that. They created an encryption
1220690	1230650	protocol. It worked. It actually used port 443, but didn't use TLS, used another encryption method.
1231510	1237150	So, it worked, it solved the problems, but it really didn't get much traction
1237930	1244530	at the time with anybody. Because, you know what? DNS is kind of boring.
1246470	1254510	So, fast forward a little bit. Next slide. DNS over TLS, or commonly known as DOT.
1254510	1263230	This was an RFC process issued May 2016. And this is basically traditional DNS
1263230	1271070	with TLS encryption running on a different port. This uses TCP port 853. And the nice thing about
1271070	1279800	that is it keeps the network control traffic separate from your application data traffic.
1281440	1291960	Now, you may not be aware, but... next slide, please... support for TLS at DNS over TLS DOT
1291960	1302380	has actually been around for a while. It started in Android 9 for the whole OS. So,
1302380	1308660	if you have recent Android, it's enabled by default and it will just work if it's supported
1308660	1316320	by the server that you're talking to. Microsoft says they may eventually support DOT in the
1316320	1326000	operating system. And Apple is going to be supporting DOT in the new iOS 14 and in macOS 11.
1326000	1338620	So, this is fairly recent developments. And this is good to have encrypted DNS,
1338620	1346260	right? Next slide, please. So, there was a different group of folks that decided to create
1346260	1357520	DNS over HTTPS or DOE. This is a different RFC, 8484, issued in December of 2018.
1358240	1366920	So, this is a protocol that uses TCP port 443 with TLS encryption. What does that remind you of?
1366920	1374480	Yes, it is the same as HTTPS for websites. So, it implements DNS queries using a special
1374480	1382500	HTTP GET with JSON responses that get parsed. It can be a little bit slower
1382500	1388280	than regular DNS by several milliseconds, but it's not really a big deal.
1390920	1399640	Microsoft has actually just added support for DOE, starting in Windows 10 Preview Build 19.6.2.8.
1399800	1407360	And Apple is going to support DOE in the OS, starting in iOS 14 and macOS 11,
1407360	1417860	which are coming out this fall. So, we'll talk about why DOE and DOT exist in a little bit.
1417860	1421320	I'm going to talk about DNS in the cloud. Next slide, please.
1422760	1432480	So, you may be aware that for many years, there's been public DNS servers, usually operated by ISPs,
1432480	1435840	as a resource. If you've been around on the internet for a while,
1435840	1443640	you may recognize some of these numbers on the slide, like 4.2.2.2, operated by level 3,
1444300	1452560	75.75.75.75, which I believe is Comcast. And there's others out there. And these were really
1452560	1458980	just primarily for network engineers and network people who just needed to set up DNS to get
1458980	1467540	something working real quick. And most end users didn't really know about them. Until
1468660	1478200	DNS in the cloud. Next slide. So, Google, back in December 2009, and some of you
1478200	1485880	were probably still in high school then, they launched a service called 8.8.8.8. And why did
1485880	1491720	they do that? Well, they said they wanted to improve the speeds and the user experience
1492680	1501260	versus a lot of ISPs that had broken DNS and still do. And I believe that.
1501800	1508000	It also gave them all sorts of data about what people were doing and where they were going.
1508260	1518380	Now, using Google DNS back then was useful to work around censorship issues at the time.
1519160	1526260	You may or may not remember this picture, which will probably take a minute and a half to load
1526260	1533160	on the stream. It's a picture from the Arab Spring uprising where people were actually
1533160	1542060	spray painting graffiti with the DNS numbers on buildings more than once all over the place.
1542060	1550340	And this, at the time, was actually an effective way to avoid censorship by the government.
1550340	1556970	Not so much anymore. Censorship and network control has gotten a lot more sophisticated.
1558940	1565800	Next slide, please. So, Google, they're quad nine for several years, and
1566660	1575360	there wasn't really any others. And then now there's more. Cloudflare came up with
1575760	1584100	1.1.1.1 in cooperation with the APNIC that controlled that IP space.
1584720	1590160	Then there's another organization called quad nine that is all nines.
1590800	1598660	Interesting. And then there's been other cloud-based... next slide, please... such as OpenDNS,
1598660	1603680	which is now Cisco Umbrella, because Cisco bought them, because that's what Cisco does.
1603680	1613700	They buy things. And most recently, CIRA, the Canadian.ca registry authority, they created a
1613700	1620000	new service called Canadian Shield with an IP address that is available to the public.
1623620	1634120	So, next slide, please. If you can control the DNS for what someone goes to, what they're resolving,
1634120	1640160	what your end users see, if you control the DNS, you basically control everything. It's
1640160	1649320	almost as good as controlling the entire network. Which is the reason why so much malware
1650240	1657340	that attacks home routers and things like that, they want to modify your DNS settings
1657340	1663620	on your network router, if your clients are pointed at your local router,
1663620	1673240	so that they can send you to illegitimate sites. So, next slide, please. Again,
1673240	1681640	DNS, it's great for tracking. If you monitor DNS queries, you know where everyone goes online.
1681640	1687600	Your shopping, your entertainment, what you do for work, most likely, any medical sites,
1687600	1693280	the apps you run on your phone, and even right down to depending on the device,
1693280	1697820	you can figure out what device it is in your house or your business, and particularly with
1697820	1708220	IoT devices based on those DNS queries. Next slide, please. So, if you control the DNS,
1708220	1716940	again, you control where users go or don't go. I believe strongly DNS monitoring is great for
1716940	1722820	fighting malware and intrusions, and I, again, say it is essential for Blue Team network defense
1722820	1735940	and monitoring. Ah, but DNS also is money, because many ISPs, and this includes your cell phone
1735940	1743520	company, because they are, in fact, an ISP, because you use data on your phone. Many of these ISPs,
1743520	1750720	including your cable TV companies, iLex, telcos, wireless carriers, et cetera, they are monitoring
1750720	1758360	your DNS, and they are actually, many of them, selling that information to a variety of data
1758360	1765360	brokers and advertising companies and other companies that want to track people. And in some
1765360	1774920	cases, those ISPs and carriers, they actually own some of the advertising companies themselves,
1774920	1781400	which is why, when they say things in their acceptable use policy, like, we will not sell
1781400	1802610	your data, that they're able to tie you directly via your cell phone ID numbers, your home IP
1802610	1809250	address range, whatever IP address you had at the time, they can tie that data directly to you
1809250	1816890	demographically. They know it's you and not somebody else. Next slide, please. So,
1817950	1825010	there are different estimates what this data is worth and how they can sell it for. I have seen
1825010	1834490	everything from $3 a year per subscriber up to several hundred. I think it varies upon the
1834490	1841070	demographics of the value of the person. So, if you are not paying for a product
1841610	1854770	on the Internet, you are the product. So, next slide. So, why do we have Doe? Well,
1854770	1861990	the reason we have Doe is, up until just recently, the operating system vendors,
1861990	1868470	really, they had not implemented any sort of encrypted DNS. They are now about to release
1869390	1877470	dot support. But for years, they really weren't doing anything. So, some of the browser makers,
1877470	1883710	like Firefox, Mozilla, they decided that they needed to take matters into their own hands,
1883710	1894770	and that's in part how Doe came about. So, Firefox added Doe support in September of 2018.
1895970	1903050	And then, in January of this year, they made it an option that you could enable Doe,
1903050	1912170	if you wanted to, in Firefox. But since February 25th of this year,
1912170	1919750	Doe is now enabled by default for all Firefox users in the U.S. Next slide, please.
1920250	1928950	So, this is a picture of the opt-out in Firefox. And I think most end users are just going to see
1928950	1934830	this thing and say, okay, yeah, that's great. It's more encryption and it's more privacy.
1936570	1946650	And, in fact, that is true, to a point. So, Mozilla picked Cloudflare as their first and
1947110	1951590	default Doe provider. And they drew up a contract and there's various requirements
1952190	1961610	that they have to honor. And that's interesting.
1963970	1972290	Firefox also includes a domain name canary, which is something that your ISP can set
1972290	1977120	in their DNS servers, which will actually disable Doe in Firefox.
1977510	1983890	Because you see, there's a whole lot of tension over who gets to monetize you.
1986570	1992050	Because you are the product. So, the ISPs have been doing the monetization.
1992650	1997650	And now there are other folks that would like to do that. And it's also the monitoring.
1998410	2004010	Next slide, please. So, there are other web browsers besides Firefox
2005030	2011810	supporting Doe now. Chrome supports it, but it's not enabled by default yet. I understand there's
2011810	2020170	some A-B testing going on and I imagine Chrome will be enabling it soon. But Chrome says they
2020170	2031230	will have a GPO that will enable you to disable Doe entirely. Microsoft Chromium Edge supports it.
2031230	2036890	It's not enabled by default. Opera supports it. Brave supports it, et cetera. Not enabled by
2037130	2046130	default. So, you know, Doe does encrypt things. And it makes it harder for people to see
2046790	2052150	where you're going on the internet by encrypting your DNS traffic.
2053310	2059370	But this is a double-edged sword. There's a lot of malware now using Doe.
2061820	2066360	And because it's using Doe, you're not seeing that traffic anymore.
2066920	2075060	There's been at least one piece of malware, the, I guess, God Lula backdoor for Linux and Windows,
2075060	2081540	and that came out in January of 2019. And it was using Doe for its CNC servers.
2082340	2088220	And I expect there's going to be all sorts of additional malware developed that's going to use
2088220	2093800	Doe because it makes it easier, you know, for them to hide. So, I think you're going to need
2093800	2098540	to start deploying man-in-the-middle TLS proxies in your corporate environments
2098540	2102260	if you aren't already. Next slide, please.
2104600	2112660	And again, I think the Adversaries TTPs are changing to adapt to Doe. I suspect there's
2112660	2119340	probably some malware out there in the wild using Doe that people don't even know about right now.
2119880	2123760	I think that's going to be a big, big thing for the rest of this year and next year.
2126080	2136980	So, DNS in the cloud, going back to that. It's really surveillance. Next slide, please.
2137680	2144000	Not all of the DNS cloud providers have a clear privacy policy. Some things they're retaining
2144000	2151800	for a couple of years in summary, maybe just 24 hours. Okay, some of that doesn't bother me.
2151800	2161920	Some of it does. However, everybody is just assuming that Doe actually does give you privacy.
2162480	2173460	And the answer is, not as much as you think. It also is centralizing your DNS queries by using
2174300	2180880	these sort of well-known cloud providers to provide DNS service for all sorts of people.
2181520	2188600	You're really centralizing the places where that data can be monitored and collected.
2192080	2202600	So, DNS over HTTPS, it's not as secure. Next slide, please. We're up to 49.
2204380	2212080	Doe doesn't actually encrypt the data that you can't get in other unencrypted forms.
2212160	2220200	You see, because where you go with Doe, SNI information, the IP address you're actually
2220200	2229400	talking to, OSCP checks for certificates, and all of that is still in clear text.
2229400	2235000	So, it's... and if they know the IP address of the website you're going to,
2235000	2240380	there's been studies that can pretty much correlate that with, you know, the website,
2240380	2248180	something like 85% of the time. So, you think that you may be getting all sorts of privacy
2248180	2256780	from using Doe, but you're not. Just because they can't see exactly what DNS queries you
2256780	2263480	are issuing doesn't mean they can't figure out what you're actually doing. Next slide.
2263480	2273620	Here's a tweet from DA667 pointing out some of the same things. It really consolidates trust
2273620	2280980	of confidential data to organizations that may not deserve it. Next slide, please.
2281460	2290080	And then we have TLS session resumption tickets. And this was an area that I did not know about
2291040	2296520	and was unaware of until I started doing the research for this talk.
2298000	2304960	These are basically unblockable cookies that can track you everywhere you go by resuming
2304960	2310240	your previous TLS sessions. Now, this was done and included in the standards to
2310240	2317040	help reduce session setup time and increase performance. But by renewing these resumption
2317040	2325100	tickets, which can be done over a long period of time, up to seven days with TLS 1.3,
2325100	2332240	that provides a method to track you across the internet no matter what you're doing
2332960	2340140	and where you're doing it. So, if you get up in the morning and you are using your phone
2340580	2345700	at home, let's say on your home Wi-Fi, and then you leave and you go out in the world
2345700	2352560	and you use your phone on your cellular carrier with cellular data, you go to an office,
2352560	2358840	back when people used to do that, go to a coffee shop, back when that was standard to do,
2359440	2364500	any Wi-Fi that you use, they're still able to track you. You go someplace else, you go back home.
2364500	2370600	The point is, is that across all of those sessions in all of those multiple ISPs and
2370600	2377300	multiple wireless networks, we're tracking directly back to you because of these session
2377300	2394480	resumption tickets. The other problem with DNS in the cloud, particularly people outside the US,
2394480	2401120	they're USA-based, USA companies. So, that means they are subject to getting national security
2401120	2411980	letters. They're subject to FISA 702 and other laws. So, that means that the government can go
2411980	2419240	to one of these providers and say, we would like a copy of all of your server logs. And yes,
2419240	2426180	you may be deleting them, but we don't have to. And if it's a national security letter,
2426180	2434770	they can't even talk about it or tell anyone. So, by centralizing into these cloud services,
2435620	2441830	it just makes it easier for governments and law enforcement to get your information.
2443310	2452210	So, what do we do about all of this? Next slide. So, I have some recommendations.
2452790	2460590	Number one, if you should be running your own internal recursive DNS server for your network,
2460590	2465450	this will give you the absolute best performance for DNS because it's the lowest latency because
2465450	2470930	it's on your network. Now, the good news is, if you're in a corporate environment,
2470930	2474610	you're probably running Microsoft Active Directory, you're already running
2475130	2479790	a local recursive DNS server, but it's probably not set up well.
2480710	2486390	You should have this internal recursive DNS server, and you should put all kinds of logging
2486390	2492750	and monitoring on this server. This is where your logging and monitoring goes here. Because
2492750	2499110	logging on the server level, of course, it's decrypted those packets. This allows you to
2499110	2507930	monitor your internal endpoint traffic. Next slide. On your firewalls, you set your firewalls
2507930	2517030	to block all TCP and UDP port 53 traffic for all your endpoints out to the world. So, they can't
2517030	2524710	use regular DNS. This will force your endpoints to use your internal DNS. You also want to block
2524710	2536330	TCP port 853 to block DOT on your corporate firewall. Now, when it comes to DOE, DOE is a lot
2536330	2544150	harder to block because DOE looks just like regular HTTPS traffic. So, there are some vendors,
2544150	2548810	depending on what kind of firewall that you have, and which vendor, and how much money you're giving
2548810	2555890	them. They have some rule sets to help enable blocking of DOE. Some of them work just by
2555890	2563250	blocking the IP addresses of well-known DOE servers. Others actually use man-in-the-middle
2563250	2569990	proxy functionality built in their solutions, and they may have rule sets. This is an area where I
2569990	2576550	think a lot of corporate defenders are going to need to invest time specifically to monitor DOE
2576550	2584210	queries via some sort of man-in-the-middle proxy that you're going to have to manage.
2585650	2593330	And this is what you're going to have to do, ultimately. You're going to want to set your
2593330	2602050	endpoint configuration standards to disable DOE in any browsers on your endpoints. And you do have
2602050	2609010	endpoint configuration standards, right, in your organization? That magical golden image,
2609010	2616230	as they say. So, you want to make sure that all of your endpoints are configured to talk to your
2616230	2622430	internal recursive servers only. Yeah, whatever method you have to do that, whether it's DHCP
2622430	2631730	options, group policy objects, static configs, registry keys, whatever, make it so. You can also
2631730	2642730	set up DOE logging in Firefox if you have to use Firefox. So, now that you have everybody talking
2643570	2651810	to your internal recursive servers, that's great. But now you want to protect your traffic
2651810	2659150	from those servers out to the internet. Because if you don't do that, then it's still possible
2659150	2664610	to watch the data stream coming out of your environment, whether that's home or at work.
2664850	2671630	So, you can set your internal servers to use an external resolver where it will just automatically
2671630	2677470	forward, as some of the software calls this forwarding, all of those queries to a particular
2677470	2684590	outside server rather than talking to the root servers directly. So, if you do this, if you
2684590	2689790	have an internal recursive server and you tell it to talk to some external server
2689790	2692560	over an encrypted protocol, whether that's
2694430	2703710	DOT or DNS Crypt, DOE still leaks information, and you use an external server,
2704350	2712800	particularly an external server in a GDPR country that has some actual privacy protection,
2712800	2719540	and if that server has enough other users, you're going to get a privacy mixer sort of
2719540	2725500	herd protection for your DNS queries. If there's tens of thousands or hundreds of thousands of
2725500	2731920	people all using a particular server, it's going to be a lot easier, a lot harder rather than
2731920	2740180	that to tie those queries back to you. The other option that you can do is you can set up your own
2740180	2747760	DOH server in like a VPS. If you trust DOH, you can also set up your own DOT server.
2747880	2753760	It's not very hard, and if you are at all handy with a Linux command line,
2753760	2758460	it's the sort of thing that you can do in, you know, a couple hours.
2760780	2765380	Another recommendation for your, particularly for your corporate networks, but I would also
2765380	2774340	extend this to any power user geek home network, is you want to capture all of the IP addresses of
2774340	2782320	those well-known public DNS resolvers in addition to doing a block at the edge. And this is because
2782320	2789960	you will be surprised to find out how many devices are using some sort of hard-coded DNS.
2790620	2797120	In particular, I know Google Chromecasts, they ignore whatever you set in DHCP.
2797580	2806540	They will use Google DNS always, and there's others. So, many, many ISPs and a lot of hotel
2806540	2812280	hospitality networks already do this sort of network capturing, and you just haven't noticed.
2812300	2818860	Many times you think you may be talking to Google Quad 8 or some other server, but you're not.
2818860	2825140	Just something they've done particularly in hospitality networks to give you that hotspot login.
2826680	2835180	Next slide. Now, a recommendation if you're in a small business environment or home environment,
2836040	2844920	you might want to use Quad 9 or Cisco Umbrella or Canadian Shield if you're not as concerned
2844920	2850440	with privacy issues, because all of those services include some malware blocking,
2850440	2856220	where they get threat intelligence feeds about the latest command and control servers,
2856220	2864580	the latest compromised servers that are feeding downloads of malware. And so, they are specially
2864580	2872080	set up to not return the correct DNS information for any of those DNS queries. So, that provides
2872360	2881260	a level of additional protection, particularly in an environment that just simply can't afford
2881260	2889200	anything else. The other recommendation that I give everyone, particularly, you know,
2889200	2895840	enthusiasts, is you want to look at running something like PyHole. Next slide. PyHole
2895840	2900960	was originally meant to run on a Raspberry Pi. It doesn't have to. You can run it pretty much
2900960	2908700	on any Linux or in a container. And it works by blocking advertising servers, known advertising
2908700	2914780	servers. And it's pretty effective. It's not perfect, but it's pretty effective. And you can
2914780	2924040	use PyHole to do your internal resolution and then chain it to external DOH servers or DOT.
2925000	2932420	So, that's my presentation. And remember, it's always DNS. Always.
2934180	2940640	I will be making this slide deck available for download. There is a whole bunch of bibliography,
2940640	2947220	about five pages of interesting links. If you are at all interested in this sort of topic,
2947220	2954600	I recommend that you read much further. Also, there are various folks in the DNS community,
2954600	2959460	the true legends, like Paul Vixie, who is one of the original authors of Bind, and he's been
2959460	2969660	doing DNS for decades. And Bert Hubert of PowerDNS. Those guys have many wonderful talks
2969660	2977100	available on YouTube. And they are the real experts. I'm just the guy doing some research
2977100	2979360	bringing it to you folks.
2981420	2984040	Jim, thank you so much. That was amazing.