WEBVTT 00:00.000 --> 00:01.220 Thank you, Giglio. 00:01.220 --> 00:03.040 I appreciate the heads up there. 00:04.640 --> 00:08.100 Well, good evening, good afternoon, good morning, wherever you are. 00:08.820 --> 00:11.520 And welcome back to the DEF CON group's village. 00:12.020 --> 00:18.400 I'm here from DC 603, which if your phone code, phone area code memory is not great, is New Hampshire. 00:19.240 --> 00:23.420 And so 603 does, as an MPA, cover all of New Hampshire. 00:23.420 --> 00:27.720 But really, we are located in the Upper Valley. 00:28.300 --> 00:35.640 And I'm going to ask that the speaker assistant here advance the slide to the next slide real quick. 00:36.340 --> 00:49.460 And so we're like halfway up New Hampshire, which makes it far enough away from Boston that we're not really part of the Boston commuter area, the Boston suburbs that kind of extend into the southern part of the state. 00:49.460 --> 00:55.980 And there's an awful lot of security meetups down in that area and around Boston generally. 00:56.520 --> 01:04.520 So we are actually up in an area that has a lower population density and definitely a lower tech job density. 01:05.380 --> 01:07.580 And if you could advance the slide, that'd be great. 01:07.580 --> 01:08.780 There we go. 01:08.840 --> 01:12.140 And let's just go one more part of that, please. 01:13.900 --> 01:17.120 I think that's an interesting red that we've got there on the state. 01:17.720 --> 01:19.720 The wonders about space VR. 01:19.720 --> 01:42.700 So just as an aside, I will say that if we make it through this slide, this talk today, I don't know about Jim Troutman, my compatriot here who I'll introduce in a second, but certainly from my point of view, I feel like this may be the most complicated setup we've done for a talk. 01:42.700 --> 01:47.040 So I'll feel like I can present on mainline or present anywhere if I can make it through this one. 01:47.040 --> 01:50.780 So thank you for bearing with us as we do this. 01:50.780 --> 02:01.260 And so what you should be seeing on Twitch is that we've got... there we go. 02:02.180 --> 02:03.300 That's weird. 02:03.300 --> 02:10.880 So I don't know where the slide is at right now because I see something on Twitch that is... 02:10.880 --> 02:11.520 oh, there we go. 02:11.520 --> 02:11.900 I got it. 02:11.900 --> 02:12.240 I got it. 02:12.240 --> 02:13.780 It just came through on my Twitch. 02:14.020 --> 02:25.300 So yeah, so that meeting room that you see there, that was our last virtual meeting back in March, and our last physical meeting back in March. 02:25.300 --> 02:39.700 And of course, with the lockdown situation, which I think we'd originally figured would not maybe last quite as long as it has so far, and as it looks like it's going to, we didn't immediately dive into a virtual mode, although we're kind of spinning that up more now. 02:40.140 --> 02:54.720 But yeah, so we've been getting together in person every month, and having some talks that are accessible if you're listening to this, and if you're in the area and you're new, and you're like, well, I'm not a super, super skilled hacker. 02:55.120 --> 02:55.880 It doesn't matter. 02:55.880 --> 02:56.600 Come along. 02:56.600 --> 03:12.860 I think as long as you've got the interest in the topic and the passion in the topic, we're going to be delighted to contribute to you and get your contribution and your experience back and just work as a group to share those experiences and expertise. 03:12.940 --> 03:36.180 So in the case of the talk that we're about to present, this is actually a talk that Jim Foutman has done before, and he gave the talk originally at ShmooCon as part of the ShmooCon Fire Talk series, and won the top prize for that this past year at ShmooCon. 03:36.180 --> 03:47.280 But when we did it locally in DC603, what happened there was it provoked an awful lot of conversation, and that's typically how it goes, right? 03:47.280 --> 03:59.360 We're looking to have not just, you know, talk sessions, but we're looking to have a meetup where it's small enough that we can really dive in and talk about some sort of topics in some detail. 03:59.860 --> 04:04.960 The Twitter that we have is easily, you know, findable. 04:04.960 --> 04:10.220 It's DC underscore 603, because I think somebody else has spotted on DC603. 04:10.220 --> 04:16.400 But yeah, if you follow us, DC underscore 603, it's a low volume list. 04:16.400 --> 04:19.460 We're just sending out when there's particular things to be aware of. 04:19.460 --> 04:26.980 And then we also have a Slack, which if you want to join with us and come to meetings and so forth, we can get you on Slack. 04:27.160 --> 04:40.980 And I think the expectation coming out of this DevCon is, I think there's going to be some evolution with how we're doing Discord, and I suspect we'll probably look to do more with Discord going forward. 04:40.980 --> 04:49.940 So rather than preempt that, we'll wait and see how that plays out through Con and after closing, and then, you know, any updates with that there. 04:49.940 --> 04:54.480 So I don't think, with the way this is set up, that I'm going to be able to hear anyone's questions. 04:54.480 --> 05:05.280 If there are questions that you want to try and yell out, go for it or throw it into the text in Discord, and I'll take a look at that and catch up on that and maybe get back to you at the end. 05:05.760 --> 05:10.000 But without further ado, we have Jim Froutman on the line with us. 05:10.000 --> 05:13.220 He is ventriloquizing through me. 05:13.240 --> 05:21.680 So, you know, you're seeing, I think, one disembodied body on stage, but there's actually two of us in the one body, which is kind of how I feel about Jim. 05:21.680 --> 05:23.000 He's an amazing guy. 05:23.000 --> 05:27.080 Some of you probably know he does Sky Talks with me or I do Sky Talks with him. 05:28.640 --> 05:39.020 And he is with us here to dive in on a topic that has been part of his life, I think, for a hell of a long time. 05:39.020 --> 05:43.760 He's been playing around with telecom and DNS and all that stuff forever. 05:44.160 --> 05:51.640 And when he first said to me many months ago, he was going to do a talk on DNS, I was like, oh, cool, that's a neat 101 talk. 05:52.680 --> 06:01.580 And then he did the talk, I'm like, oh, my goodness, there is so much about this that I've just been oblivious to and not keeping up on the tech. 06:01.580 --> 06:03.420 And there's some really interesting stuff here. 06:03.420 --> 06:06.640 So, if you think you know DNS, maybe you do. 06:06.920 --> 06:11.400 More power to you, but I suspect there's a few folks out there that are going to learn something today. 06:11.500 --> 06:13.120 Jim, over to you, man. 06:14.100 --> 06:16.060 Hey, good afternoon. 06:16.060 --> 06:17.640 Can you guys hear me? 06:18.200 --> 06:19.540 They better. 06:19.540 --> 06:20.800 Just keep going. 06:20.880 --> 06:21.760 We hope so. 06:21.760 --> 06:22.580 All right. 06:22.680 --> 06:28.560 Well, if we can take the slide, if we can take the slide forward to the title slide. 06:30.920 --> 06:32.040 Thank you. 06:32.520 --> 06:40.000 So, thank you, guys, for the DC Groups team for setting this up and making all this work. 06:40.000 --> 06:48.480 And I know there's been a lot of technical challenges, but I think it's been a good learning experience for everybody involved. 06:48.480 --> 06:55.620 And thank you to Donald for inviting me to come and do this presentation today. 06:56.200 --> 06:57.200 Okay. 06:57.260 --> 07:00.460 So, DNS New World Order. 07:00.560 --> 07:04.040 What the fuck? 07:04.680 --> 07:09.720 So, I'm a guy on the internet. 07:09.720 --> 07:13.980 You can find me easily. 07:13.980 --> 07:18.940 I've been around, done a lot of things in ISP land. 07:19.000 --> 07:21.760 I've been on the internet since 87. 07:23.180 --> 07:25.940 I have to issue a disclaimer. 07:26.120 --> 07:32.520 I am a director and co-founder of a non-profit internet exchange called Weenix. 07:33.120 --> 07:40.120 We happen to host some servers for one of the companies that I'm going to be discussing today, Quad9. 07:42.180 --> 07:44.180 So, just a little disclaimer. 07:44.840 --> 07:45.440 All right. 07:45.440 --> 07:48.200 So, here's what we're going to learn today. 07:48.280 --> 07:49.920 Topics of presentation. 07:50.580 --> 07:58.020 We're going to talk about the DNS system in general and some of these new encrypted DNS methods like Doe and Dot. 07:59.160 --> 08:13.340 We're going to talk about operational reasons why you should monitor your DNS, about all these cloud services that are out there offering easy-to-remember DNS servers and why would they want to do such a thing. 08:14.140 --> 08:19.880 The privacy implications of some of the web browser product decisions. 08:20.200 --> 08:33.170 And then I'm going to end with some recommendations on how to mitigate the impact of all of these new encryption methods and those cloud-based DNS services. 08:34.890 --> 08:44.090 So, this slide here, which is, talks about the new troubleshooting procedure. 08:44.690 --> 08:46.750 It is not DNS. 08:46.750 --> 08:48.890 There's no way it's DNS. 08:49.210 --> 08:50.710 It was DNS. 08:54.110 --> 08:59.710 And I'm going to pause here until the slides catch up. 09:02.730 --> 09:06.030 We should be on the one that says new troubleshooting procedure. 09:06.030 --> 09:06.830 It's not DNS. 09:06.830 --> 09:07.850 There's no way it's DNS. 09:07.850 --> 09:08.650 It was DNS. 09:08.650 --> 09:09.890 We know it was always DNS. 09:10.190 --> 09:15.690 And if Jim, if you can do a next every time from now on, hopefully we can keep it that same. 09:16.930 --> 09:20.670 So , we're on the graphic, right guys? 09:20.670 --> 09:23.490 New troubleshooting procedure sitting on a cube wall. 09:24.810 --> 09:27.370 There's a little bit of a delay on the screen. 09:27.370 --> 09:28.030 I can see that. 09:28.030 --> 09:29.210 Who would have thought? 09:29.210 --> 09:30.650 Latency on the internet. 09:31.150 --> 09:32.710 Yeah, it's amazing. 09:35.230 --> 09:38.350 All right, are we going to share these slides afterwards, Jim? 09:38.350 --> 09:39.270 Yes, yeah. 09:39.270 --> 09:49.790 Okay, so if there's anyone in the audience who's trying to throw bricks at us right now, we will make sure you get a copy of the slide deck and you can just play it through in your own mind afterwards again. 09:50.430 --> 09:51.550 Yes. 09:52.930 --> 09:55.270 Oh, I see it loading. 09:55.270 --> 09:56.930 I see your cube wall loading. 10:01.650 --> 10:05.450 It's rendering like line by line on my Twitch. 10:05.450 --> 10:06.450 I don't know about yours. 10:06.450 --> 10:08.670 Yeah, I apologize. 10:08.670 --> 10:09.470 That's awesome. 10:09.470 --> 10:11.030 Apparently, my slides... 10:16.610 --> 10:19.150 They're not even all that complicated. 10:19.150 --> 10:20.950 Hey, look, graphics. 10:20.950 --> 10:23.090 Masterized PNGs, right? 10:23.090 --> 10:23.250 Yeah. 10:23.870 --> 10:31.690 I wonder if it's like upscaling them into some sort of ludicrously detailed resolution that it doesn't need to. 10:31.830 --> 10:35.810 Anyway, I'm proceeding onward. 10:35.810 --> 10:37.830 So, let's talk about DNS. 10:37.830 --> 10:38.950 Next slide. 10:39.310 --> 10:41.630 So, what the heck is DNS? 10:41.650 --> 10:43.490 So, it's the domain name system. 10:44.250 --> 10:54.350 And it is really about the most fundamental technology that makes the internet work other than packets and wires and fiber. 10:54.950 --> 11:00.230 And it works so well that most people never even think about it. 11:00.230 --> 11:02.710 We don't think about it until it breaks. 11:02.890 --> 11:06.830 Most end users really have no knowledge about it. 11:07.290 --> 11:20.970 So, what DNS does is that it simply converts the names that humans can remember into numbers, which is what computers use, network addresses. 11:21.130 --> 11:22.650 Next slide, please. 11:24.060 --> 11:32.310 It's also used internally by almost every organization because almost everybody's running Microsoft Active Directory. 11:32.430 --> 11:33.890 And guess what? 11:33.890 --> 11:41.230 Active Directory depends entirely on DNS working correctly and reliably. 11:41.230 --> 11:43.370 Next slide, please. 11:46.370 --> 11:51.650 So, really, everything you do on the internet needs DNS to function. 11:52.290 --> 12:03.950 This is why a lot of people will say something like, and I'm sure those of you in the audience that have done any sort of tech support or help desk, you've heard this before, the internet is down. 12:04.410 --> 12:06.670 And usually, that's not the case. 12:06.670 --> 12:08.790 The internet is just fine. 12:08.790 --> 12:12.450 But DNS resolution was broken for that user. 12:13.000 --> 12:18.370 So, DNS requests are usually called queries. 12:19.110 --> 12:21.010 And next slide, please. 12:23.040 --> 12:37.890 These queries that you issue all the time with your browser and with your phone and pretty much every single app that you use, they reveal an awful lot about you and what you are doing online. 12:37.890 --> 12:41.870 The games you play, email, et cetera. 12:42.410 --> 12:45.350 So, a little refresher about what DNS is. 12:45.350 --> 12:46.850 Next slide, please. 12:47.890 --> 12:50.110 Domain names are hierarchical. 12:50.190 --> 12:52.890 They start at the root or the dot. 12:52.890 --> 12:55.110 And then we have top-level domains. 12:55.590 --> 13:06.710 And there's the original generic top-level domains like .com and .gov and .net or various country codes like .uk, .jp. 13:07.810 --> 13:13.510 Originally, there was just a very few number of top-level domains. 13:13.510 --> 13:15.950 Now there's more than a thousand. 13:16.210 --> 13:25.150 You have such things as .bank, .coop, even .horse, which is kind of fascinating. 13:27.600 --> 13:28.300 All right. 13:28.300 --> 13:31.160 So, this next slide, please. 13:35.090 --> 13:39.010 So, we have some example DNS names. 13:39.630 --> 13:44.630 Google.com, www.bbc.co.uk, et cetera. 13:44.630 --> 13:46.130 You get the idea. 13:46.290 --> 13:49.610 Most of you guys know how DNS is structured. 13:50.110 --> 13:54.130 So, DNS is a service that converts names into numbers. 13:54.130 --> 13:58.990 So, for example, next slide, please. 13:58.990 --> 14:05.290 You look up a record like www.cnn.com when you punch that into your browser. 14:05.470 --> 14:13.610 You'll get an IPv4 address that you can almost remember, 151.101.167. 14:13.610 --> 14:22.110 But with IPv6, you're going to get a big, long hexadecimal address that nobody in the world should try to remember. 14:22.150 --> 14:24.570 This is why we have DNS. 14:25.630 --> 14:27.450 Next slide. 14:27.930 --> 14:37.690 So, DNS was originally conceived in 1983, roughly. 14:37.690 --> 14:41.970 At least the RFC was published then, RFC 882. 14:41.970 --> 14:45.830 And that was superseded by RFC 1035 in 1987. 14:45.830 --> 14:51.430 And that is basically more or less the DNS that we have today. 14:52.950 --> 15:00.310 BIND, the Berkeley Internet named Daemon, was created in 1985. 15:01.590 --> 15:08.890 And this DNS is really the last major plain text protocol that's left on the Internet. 15:08.890 --> 15:14.450 Although, as we're going to discuss, there's lots of people trying to make it go away. 15:14.970 --> 15:18.170 A little more background on the DNS. 15:18.290 --> 15:22.250 In order for DNS to work, you have to have the root servers. 15:22.310 --> 15:23.870 Next slide, please. 15:24.450 --> 15:30.130 The 13 root servers in the world, lettered A through M. 15:30.570 --> 15:33.990 And they're operated by 12 different organizations. 15:33.990 --> 15:43.410 And it's important to understand that these 13 servers that are the root of the DNS, they are by no means individual servers. 15:43.410 --> 15:50.690 These are clusters of servers with load balancers and multiple instances all over the world. 15:50.690 --> 15:59.030 Some of these root servers have over 160 separate physical instances around the world in various data centers. 15:59.030 --> 16:16.410 Because they're so widely distributed, this allows scaling of traffic volumes and lots of increased resiliency and redundancy, particularly against directed attacks like DDoS attacks, which root servers get all day long. 16:16.470 --> 16:18.210 Next slide, please. 16:18.510 --> 16:30.870 So, all of the root servers in the letters A through M, they get a massive amount of traffic in terms of queries and transactions. 16:30.870 --> 16:38.190 We're talking double digit billions of queries per day processed by these root servers. 16:38.190 --> 16:42.690 That's trillions of DNS queries per month. 16:43.390 --> 16:54.810 And the DNS has actually managed to scale over nine orders of magnitude in the last 35 years. 16:54.990 --> 16:57.810 And it will continue to do so. 16:57.810 --> 17:04.570 I think that's pretty impressive for a protocol designed in the mid-80s. 17:05.290 --> 17:12.750 One of the ways that DNS scales... next slide, please... is a technique called IP NCASI. 17:12.750 --> 17:22.390 This is where you take an IP address block and you advertise it in multiple locations on the internet at the same time via BGP routing. 17:22.970 --> 17:36.350 The same address appears in multiple locations and your ISP or your network makes decisions to steer the traffic to the best, nearest instance of that IP address. 17:36.670 --> 17:43.710 So, all the DNS servers, all the root DNS and all the cloud DNS in the world uses NCAST. 17:43.850 --> 17:45.390 Next slide, please. 17:45.850 --> 17:51.650 So, we talked about traditional DNS started in 85. 17:51.650 --> 17:58.490 It's what some people are now calling DO-53, since we have DOH and DOT. 17:58.670 --> 18:02.770 DO-53 is the original unencrypted DNS. 18:03.440 --> 18:10.170 So, it's UDP port 53 for queries, TCP port 53 for zone transfers. 18:10.410 --> 18:16.050 And it's, again, it's been largely the same for the last 35 years. 18:16.250 --> 18:18.230 Next slide, please. 18:18.230 --> 18:27.690 The wonderful thing about DNS from a network management point of view and a security point of view is that it's plain text. 18:27.690 --> 18:30.970 So, you can monitor it over the wire very easily. 18:31.930 --> 18:42.890 And I have to say, if you're in a corporate environment and your IT security staff isn't monitoring DNS, they're doing it wrong. 18:42.890 --> 18:52.710 If you are the IT security staff for your organization and you are not monitoring DNS, you really ought to. 18:52.970 --> 18:59.310 It is incredibly useful to monitor DNS, lets you know what your endpoints are up to. 18:59.310 --> 19:08.390 It makes it easier to find malware and, of course, good old AUP violations on your network. 19:09.270 --> 19:10.750 Next slide, please. 19:11.410 --> 19:21.250 So, there is some other, and some people have thought, well, that's kind of a problem. 19:21.250 --> 19:26.430 I don't really want people to know what I'm doing and what my DNS queries are. 19:26.710 --> 19:41.950 So, there was a group of folks that were not IETF and did not come up with an official standard, but they created a thing out of the free VSD community called DNS Crypt. 19:41.950 --> 19:45.630 And I skipped over DNSSEC. 19:45.830 --> 19:48.250 You may have heard of DNSSEC. 19:48.470 --> 19:59.070 It's a way to cryptographically authenticate DNS data, but it doesn't actually hide it, it just authenticates it. 19:59.070 --> 20:05.990 And DNSSEC is really not a topic of this presentation, it's like a whole other presentation unto itself. 20:06.510 --> 20:07.370 Okay. 20:07.770 --> 20:09.270 Next slide. 20:09.310 --> 20:17.470 DNS Crypt, 2011, bunch of folks in the free VSD world were instrumental in that. 20:17.470 --> 20:21.470 They created an encryption protocol. 20:21.470 --> 20:22.270 It worked. 20:22.270 --> 20:30.650 It actually used port 443, but didn't use TLS, used another encryption method. 20:31.510 --> 20:41.530 So, it worked, it solved the problems, but it really didn't get much traction at the time with anybody. 20:41.530 --> 20:43.090 Because, you know what? 20:43.090 --> 20:44.530 DNS is kind of boring. 20:46.470 --> 20:49.450 So, fast forward a little bit. 20:49.710 --> 20:50.910 Next slide. 20:50.910 --> 20:54.510 DNS over TLS, or commonly known as DOT. 20:54.510 --> 21:00.230 This was an RFC process issued May 2016. 21:00.370 --> 21:06.790 And this is basically traditional DNS with TLS encryption running on a different port. 21:06.790 --> 21:09.950 This uses TCP port 853. 21:09.950 --> 21:19.800 And the nice thing about that is it keeps the network control traffic separate from your application data traffic. 21:21.440 --> 21:35.180 Now, you may not be aware, but... next slide, please... support for TLS at DNS over TLS DOT has actually been around for a while. 21:36.740 --> 21:42.180 It started in Android 9 for the whole OS. 21:42.180 --> 21:51.520 So, if you have recent Android, it's enabled by default and it will just work if it's supported by the server that you're talking to. 21:52.200 --> 21:57.880 Microsoft says they may eventually support DOT in the operating system. 21:58.220 --> 22:06.000 And Apple is going to be supporting DOT in the new iOS 14 and in macOS 11. 22:06.000 --> 22:09.520 So, this is fairly recent developments. 22:09.520 --> 22:18.640 And this is good to have encrypted DNS, right? 22:19.420 --> 22:21.700 Next slide, please. 22:21.900 --> 22:30.300 So, there was a different group of folks that decided to create DNS over HTTPS or DOE. 22:30.300 --> 22:37.520 This is a different RFC, 8484, issued in December of 2018. 22:38.240 --> 22:44.520 So, this is a protocol that uses TCP port 443 with TLS encryption. 22:44.520 --> 22:46.920 What does that remind you of? 22:46.920 --> 22:51.280 Yes, it is the same as HTTPS for websites. 22:51.600 --> 22:59.620 So, it implements DNS queries using a special HTTP GET with JSON responses that get parsed. 23:00.720 --> 23:08.280 It can be a little bit slower than regular DNS by several milliseconds, but it's not really a big deal. 23:10.920 --> 23:19.640 Microsoft has actually just added support for DOE, starting in Windows 10 Preview Build 19.6.2.8. 23:19.800 --> 23:29.560 And Apple is going to support DOE in the OS, starting in iOS 14 and macOS 11, which are coming out this fall. 23:31.500 --> 23:37.860 So, we'll talk about why DOE and DOT exist in a little bit. 23:37.860 --> 23:39.960 I'm going to talk about DNS in the cloud. 23:39.960 --> 23:41.320 Next slide, please. 23:42.760 --> 23:53.380 So, you may be aware that for many years, there's been public DNS servers, usually operated by ISPs, as a resource. 23:53.380 --> 24:08.800 If you've been around on the internet for a while, you may recognize some of these numbers on the slide, like 4.2.2.2, operated by level 3, 75.75.75.75, which I believe is Comcast. 24:08.800 --> 24:10.560 And there's others out there. 24:10.840 --> 24:20.820 And these were really just primarily for network engineers and network people who just needed to set up DNS to get something working real quick. 24:21.940 --> 24:25.980 And most end users didn't really know about them. 24:26.940 --> 24:30.580 Until DNS in the cloud. 24:30.580 --> 24:31.580 Next slide. 24:31.920 --> 24:44.420 So, Google, back in December 2009, and some of you were probably still in high school then, they launched a service called 8.8.8.8. 24:44.420 --> 24:47.020 And why did they do that? 24:47.020 --> 24:58.100 Well, they said they wanted to improve the speeds and the user experience versus a lot of ISPs that had broken DNS and still do. 24:58.500 --> 25:01.260 And I believe that. 25:01.800 --> 25:08.000 It also gave them all sorts of data about what people were doing and where they were going. 25:08.260 --> 25:18.380 Now, using Google DNS back then was useful to work around censorship issues at the time. 25:19.160 --> 25:27.620 You may or may not remember this picture, which will probably take a minute and a half to load on the stream. 25:27.900 --> 25:42.060 It's a picture from the Arab Spring uprising where people were actually spray painting graffiti with the DNS numbers on buildings more than once all over the place. 25:42.060 --> 25:50.340 And this, at the time, was actually an effective way to avoid censorship by the government. 25:50.340 --> 25:52.700 Not so much anymore. 25:53.140 --> 25:56.970 Censorship and network control has gotten a lot more sophisticated. 25:58.940 --> 26:01.020 Next slide, please. 26:01.260 --> 26:09.180 So, Google, they're quad nine for several years, and there wasn't really any others. 26:09.360 --> 26:13.420 And then now there's more. 26:13.420 --> 26:24.100 Cloudflare came up with 1.1.1.1 in cooperation with the APNIC that controlled that IP space. 26:24.720 --> 26:30.160 Then there's another organization called quad nine that is all nines. 26:30.800 --> 26:31.800 Interesting. 26:31.800 --> 26:43.680 And then there's been other cloud-based... next slide, please... such as OpenDNS, which is now Cisco Umbrella, because Cisco bought them, because that's what Cisco does. 26:43.680 --> 26:45.240 They buy things. 26:45.700 --> 27:00.000 And most recently, CIRA, the Canadian.ca registry authority, they created a new service called Canadian Shield with an IP address that is available to the public. 27:03.620 --> 27:06.820 So, next slide, please. 27:06.960 --> 27:19.960 If you can control the DNS for what someone goes to, what they're resolving, what your end users see, if you control the DNS, you basically control everything. 27:19.960 --> 27:24.220 It's almost as good as controlling the entire network. 27:25.260 --> 27:47.360 Which is the reason why so much malware that attacks home routers and things like that, they want to modify your DNS settings on your network router, if your clients are pointed at your local router, so that they can send you to illegitimate sites. 27:49.360 --> 27:51.640 So, next slide, please. 27:51.640 --> 27:57.460 Again, DNS, it's great for tracking. 27:57.840 --> 28:01.640 If you monitor DNS queries, you know where everyone goes online. 28:01.640 --> 28:22.600 Your shopping, your entertainment, what you do for work, most likely, any medical sites, the apps you run on your phone, and even right down to depending on the device, you can figure out what device it is in your house or your business, and particularly with IoT devices based on those DNS queries. 28:23.140 --> 28:24.820 Next slide, please. 28:25.640 --> 28:32.920 So, if you control the DNS, again, you control where users go or don't go. 28:33.720 --> 28:44.040 I believe strongly DNS monitoring is great for fighting malware and intrusions, and I, again, say it is essential for Blue Team network defense and monitoring. 28:45.560 --> 29:00.720 Ah, but DNS also is money, because many ISPs, and this includes your cell phone company, because they are, in fact, an ISP, because you use data on your phone. 29:01.360 --> 29:24.780 Many of these ISPs, including your cable TV companies, iLex, telcos, wireless carriers, et cetera, they are monitoring your DNS, and they are actually, many of them, selling that information to a variety of data brokers and advertising companies and other companies that want to track people. 29:24.920 --> 29:47.260 And in some cases, those ISPs and carriers, they actually own some of the advertising companies themselves, which is why, when they say things in their acceptable use policy, like, we will not sell your data, that 29:52.570 --> 30:10.550 they're able to tie you directly via your cell phone ID numbers, your home IP address range, whatever IP address you had at the time, they can tie that data directly to you demographically. 30:10.550 --> 30:13.610 They know it's you and not somebody else. 30:14.250 --> 30:16.210 Next slide, please. 30:16.210 --> 30:23.850 So, there are different estimates what this data is worth and how they can sell it for. 30:23.910 --> 30:32.830 I have seen everything from $3 a year per subscriber up to several hundred. 30:32.830 --> 30:37.530 I think it varies upon the demographics of the value of the person. 30:37.870 --> 30:45.430 So, if you are not paying for a product on the Internet, you are the product. 30:46.470 --> 30:49.350 So, next slide. 30:51.890 --> 30:53.630 So, why do we have Doe? 30:53.630 --> 31:06.110 Well, the reason we have Doe is, up until just recently, the operating system vendors, really, they had not implemented any sort of encrypted DNS. 31:06.270 --> 31:10.970 They are now about to release dot support. 31:11.770 --> 31:15.410 But for years, they really weren't doing anything. 31:15.410 --> 31:26.950 So, some of the browser makers, like Firefox, Mozilla, they decided that they needed to take matters into their own hands, and that's in part how Doe came about. 31:28.730 --> 31:34.770 So, Firefox added Doe support in September of 2018. 31:35.970 --> 31:45.530 And then, in January of this year, they made it an option that you could enable Doe, if you wanted to, in Firefox. 31:46.390 --> 31:57.790 But since February 25th of this year, Doe is now enabled by default for all Firefox users in the U.S. 31:58.170 --> 31:59.750 Next slide, please. 32:00.250 --> 32:05.630 So, this is a picture of the opt-out in Firefox. 32:05.630 --> 32:11.390 And I think most end users are just going to see this thing and say, okay, yeah, that's great. 32:11.390 --> 32:14.830 It's more encryption and it's more privacy. 32:16.570 --> 32:21.470 And, in fact, that is true, to a point. 32:22.510 --> 32:28.630 So, Mozilla picked Cloudflare as their first and default Doe provider. 32:28.630 --> 32:35.430 And they drew up a contract and there's various requirements that they have to honor. 32:37.490 --> 32:41.610 And that's interesting. 32:43.970 --> 32:57.120 Firefox also includes a domain name canary, which is something that your ISP can set in their DNS servers, which will actually disable Doe in Firefox. 32:57.510 --> 33:03.890 Because you see, there's a whole lot of tension over who gets to monetize you. 33:06.570 --> 33:09.250 Because you are the product. 33:09.490 --> 33:12.050 So, the ISPs have been doing the monetization. 33:12.650 --> 33:16.130 And now there are other folks that would like to do that. 33:16.130 --> 33:17.650 And it's also the monitoring. 33:18.410 --> 33:20.210 Next slide, please. 33:21.030 --> 33:26.590 So, there are other web browsers besides Firefox supporting Doe now. 33:26.590 --> 33:30.670 Chrome supports it, but it's not enabled by default yet. 33:30.670 --> 33:37.950 I understand there's some A-B testing going on and I imagine Chrome will be enabling it soon. 33:38.150 --> 33:46.690 But Chrome says they will have a GPO that will enable you to disable Doe entirely. 33:48.270 --> 33:51.230 Microsoft Chromium Edge supports it. 33:51.230 --> 33:53.030 It's not enabled by default. 33:53.030 --> 33:54.510 Opera supports it. 33:54.510 --> 33:56.130 Brave supports it, et cetera. 33:56.130 --> 33:57.810 Not enabled by default. 33:58.390 --> 34:02.670 So, you know, Doe does encrypt things. 34:02.670 --> 34:12.150 And it makes it harder for people to see where you're going on the internet by encrypting your DNS traffic. 34:13.310 --> 34:16.110 But this is a double-edged sword. 34:16.110 --> 34:19.370 There's a lot of malware now using Doe. 34:21.820 --> 34:26.360 And because it's using Doe, you're not seeing that traffic anymore. 34:26.920 --> 34:37.460 There's been at least one piece of malware, the, I guess, God Lula backdoor for Linux and Windows, and that came out in January of 2019. 34:37.700 --> 34:41.540 And it was using Doe for its CNC servers. 34:42.340 --> 34:52.020 And I expect there's going to be all sorts of additional malware developed that's going to use Doe because it makes it easier, you know, for them to hide. 34:52.340 --> 35:00.240 So, I think you're going to need to start deploying man-in-the-middle TLS proxies in your corporate environments if you aren't already. 35:00.780 --> 35:02.260 Next slide, please. 35:04.600 --> 35:10.780 And again, I think the Adversaries TTPs are changing to adapt to Doe. 35:11.320 --> 35:19.340 I suspect there's probably some malware out there in the wild using Doe that people don't even know about right now. 35:19.880 --> 35:23.760 I think that's going to be a big, big thing for the rest of this year and next year. 35:26.080 --> 35:32.840 So, DNS in the cloud, going back to that. 35:33.620 --> 35:35.440 It's really surveillance. 35:35.440 --> 35:36.980 Next slide, please. 35:37.680 --> 35:42.820 Not all of the DNS cloud providers have a clear privacy policy. 35:42.820 --> 35:49.540 Some things they're retaining for a couple of years in summary, maybe just 24 hours. 35:49.540 --> 35:51.800 Okay, some of that doesn't bother me. 35:51.800 --> 35:53.320 Some of it does. 35:54.080 --> 36:01.920 However, everybody is just assuming that Doe actually does give you privacy. 36:02.480 --> 36:06.500 And the answer is, not as much as you think. 36:07.900 --> 36:20.880 It also is centralizing your DNS queries by using these sort of well-known cloud providers to provide DNS service for all sorts of people. 36:21.520 --> 36:28.600 You're really centralizing the places where that data can be monitored and collected. 36:32.080 --> 36:39.620 So, DNS over HTTPS, it's not as secure. 36:39.620 --> 36:41.360 Next slide, please. 36:41.420 --> 36:42.600 We're up to 49. 36:44.380 --> 36:52.080 Doe doesn't actually encrypt the data that you can't get in other unencrypted forms. 36:52.160 --> 37:09.400 You see, because where you go with Doe, SNI information, the IP address you're actually talking to, OSCP checks for certificates, and all of that is still in clear text. 37:09.400 --> 37:23.340 So, it's... and if they know the IP address of the website you're going to, there's been studies that can pretty much correlate that with, you know, the website, something like 85% of the time. 37:23.780 --> 37:31.280 So, you think that you may be getting all sorts of privacy from using Doe, but you're not. 37:31.280 --> 37:41.240 Just because they can't see exactly what DNS queries you are issuing doesn't mean they can't figure out what you're actually doing. 37:42.040 --> 37:43.480 Next slide. 37:43.480 --> 37:51.520 Here's a tweet from DA667 pointing out some of the same things. 37:51.520 --> 37:58.720 It really consolidates trust of confidential data to organizations that may not deserve it. 37:59.280 --> 38:00.980 Next slide, please. 38:01.460 --> 38:07.160 And then we have TLS session resumption tickets. 38:07.580 --> 38:16.520 And this was an area that I did not know about and was unaware of until I started doing the research for this talk. 38:18.000 --> 38:27.560 These are basically unblockable cookies that can track you everywhere you go by resuming your previous TLS sessions. 38:27.560 --> 38:34.040 Now, this was done and included in the standards to help reduce session setup time and increase performance. 38:34.060 --> 38:54.660 But by renewing these resumption tickets, which can be done over a long period of time, up to seven days with TLS 1.3, that provides a method to track you across the internet no matter what you're doing and where you're doing it. 38:54.660 --> 39:14.480 So, if you get up in the morning and you are using your phone at home, let's say on your home Wi-Fi, and then you leave and you go out in the world and you use your phone on your cellular carrier with cellular data, you go to an office, back when people used to do that, 39:14.480 --> 39:22.320 go to a coffee shop, back when that was standard to do, any Wi-Fi that you use, they're still able to track you. 39:22.320 --> 39:24.500 You go someplace else, you go back home. 39:24.500 --> 39:39.000 The point is, is that across all of those sessions in all of those multiple ISPs and multiple wireless networks, we're tracking directly back to you because of these session resumption tickets. 39:40.640 --> 39:57.760 The other problem with DNS in the cloud, particularly people outside the US, they're USA-based, USA companies. 39:57.960 --> 40:02.280 So, that means they are subject to getting national security letters. 40:02.320 --> 40:06.600 They're subject to FISA 702 and other laws. 40:06.900 --> 40:18.540 So, that means that the government can go to one of these providers and say, we would like a copy of all of your server logs. 40:18.540 --> 40:21.940 And yes, you may be deleting them, but we don't have to. 40:23.280 --> 40:29.140 And if it's a national security letter, they can't even talk about it or tell anyone. 40:30.460 --> 40:41.830 So, by centralizing into these cloud services, it just makes it easier for governments and law enforcement to get your information. 40:43.310 --> 40:47.910 So, what do we do about all of this? 40:47.910 --> 40:49.110 Next slide. 40:49.490 --> 40:52.210 So, I have some recommendations. 40:52.790 --> 41:06.910 Number one, if you should be running your own internal recursive DNS server for your network, this will give you the absolute best performance for DNS because it's the lowest latency because it's on your network. 41:07.110 --> 41:19.790 Now, the good news is, if you're in a corporate environment, you're probably running Microsoft Active Directory, you're already running a local recursive DNS server, but it's probably not set up well. 41:20.710 --> 41:28.790 You should have this internal recursive DNS server, and you should put all kinds of logging and monitoring on this server. 41:28.790 --> 41:31.870 This is where your logging and monitoring goes here. 41:32.130 --> 41:38.070 Because logging on the server level, of course, it's decrypted those packets. 41:38.070 --> 41:42.670 This allows you to monitor your internal endpoint traffic. 41:42.670 --> 41:43.670 Next slide. 41:44.610 --> 41:55.550 On your firewalls, you set your firewalls to block all TCP and UDP port 53 traffic for all your endpoints out to the world. 41:55.630 --> 41:59.350 So, they can't use regular DNS. 41:59.590 --> 42:03.450 This will force your endpoints to use your internal DNS. 42:03.610 --> 42:12.610 You also want to block TCP port 853 to block DOT on your corporate firewall. 42:13.310 --> 42:21.850 Now, when it comes to DOE, DOE is a lot harder to block because DOE looks just like regular HTTPS traffic. 42:22.230 --> 42:29.590 So, there are some vendors, depending on what kind of firewall that you have, and which vendor, and how much money you're giving them. 42:29.950 --> 42:34.450 They have some rule sets to help enable blocking of DOE. 42:34.450 --> 42:39.950 Some of them work just by blocking the IP addresses of well-known DOE servers. 42:40.370 --> 42:48.270 Others actually use man-in-the-middle proxy functionality built in their solutions, and they may have rule sets. 42:48.710 --> 43:04.210 This is an area where I think a lot of corporate defenders are going to need to invest time specifically to monitor DOE queries via some sort of man-in-the-middle proxy that you're going to have to manage. 43:05.650 --> 43:09.710 And this is what you're going to have to do, ultimately. 43:10.570 --> 43:20.170 You're going to want to set your endpoint configuration standards to disable DOE in any browsers on your endpoints. 43:20.350 --> 43:26.690 And you do have endpoint configuration standards, right, in your organization? 43:26.750 --> 43:30.270 That magical golden image, as they say. 43:31.010 --> 43:38.950 So, you want to make sure that all of your endpoints are configured to talk to your internal recursive servers only. 43:38.950 --> 43:50.370 Yeah, whatever method you have to do that, whether it's DHCP options, group policy objects, static configs, registry keys, whatever, make it so. 43:50.730 --> 43:57.790 You can also set up DOE logging in Firefox if you have to use Firefox. 44:00.030 --> 44:09.830 So, now that you have everybody talking to your internal recursive servers, that's great. 44:09.830 --> 44:14.190 But now you want to protect your traffic from those servers out to the internet. 44:14.190 --> 44:24.610 Because if you don't do that, then it's still possible to watch the data stream coming out of your environment, whether that's home or at work. 44:24.850 --> 44:41.690 So, you can set your internal servers to use an external resolver where it will just automatically forward, as some of the software calls this forwarding, all of those queries to a particular outside server rather than talking to the root servers directly. 44:42.250 --> 45:12.800 So, if you do this, if you have an internal recursive server and you tell it to talk to some external server over an encrypted protocol, whether that's DOT or DNS Crypt, DOE still leaks information, and you use an external server, particularly an external server in a GDPR country that has some actual privacy protection, 45:12.800 --> 45:22.460 and if that server has enough other users, you're going to get a privacy mixer sort of herd protection for your DNS queries. 45:22.600 --> 45:35.160 If there's tens of thousands or hundreds of thousands of people all using a particular server, it's going to be a lot easier, a lot harder rather than that to tie those queries back to you. 45:35.440 --> 45:43.500 The other option that you can do is you can set up your own DOH server in like a VPS. 45:43.500 --> 45:47.760 If you trust DOH, you can also set up your own DOT server. 45:47.880 --> 45:58.460 It's not very hard, and if you are at all handy with a Linux command line, it's the sort of thing that you can do in, you know, a couple hours. 46:00.780 --> 46:20.660 Another recommendation for your, particularly for your corporate networks, but I would also extend this to any power user geek home network, is you want to capture all of the IP addresses of those well-known public DNS resolvers in addition to doing a block at the edge. 46:21.000 --> 46:29.960 And this is because you will be surprised to find out how many devices are using some sort of hard-coded DNS. 46:30.620 --> 46:37.120 In particular, I know Google Chromecasts, they ignore whatever you set in DHCP. 46:37.580 --> 46:41.520 They will use Google DNS always, and there's others. 46:42.020 --> 46:52.280 So, many, many ISPs and a lot of hotel hospitality networks already do this sort of network capturing, and you just haven't noticed. 46:52.300 --> 46:58.860 Many times you think you may be talking to Google Quad 8 or some other server, but you're not. 46:58.860 --> 47:05.140 Just something they've done particularly in hospitality networks to give you that hotspot login. 47:06.680 --> 47:08.240 Next slide. 47:09.080 --> 47:30.440 Now, a recommendation if you're in a small business environment or home environment, you might want to use Quad 9 or Cisco Umbrella or Canadian Shield if you're not as concerned with privacy issues, because all of those services include some malware blocking, 47:30.440 --> 47:42.360 where they get threat intelligence feeds about the latest command and control servers, the latest compromised servers that are feeding downloads of malware. 47:42.820 --> 47:50.940 And so, they are specially set up to not return the correct DNS information for any of those DNS queries. 47:50.940 --> 48:03.020 So, that provides a level of additional protection, particularly in an environment that just simply can't afford anything else. 48:03.500 --> 48:13.140 The other recommendation that I give everyone, particularly, you know, enthusiasts, is you want to look at running something like PyHole. 48:13.140 --> 48:14.460 Next slide. 48:15.120 --> 48:19.000 PyHole was originally meant to run on a Raspberry Pi. 48:19.000 --> 48:19.960 It doesn't have to. 48:19.960 --> 48:23.200 You can run it pretty much on any Linux or in a container. 48:23.380 --> 48:29.420 And it works by blocking advertising servers, known advertising servers. 48:29.420 --> 48:31.120 And it's pretty effective. 48:31.120 --> 48:33.720 It's not perfect, but it's pretty effective. 48:33.740 --> 48:44.040 And you can use PyHole to do your internal resolution and then chain it to external DOH servers or DOT. 48:45.000 --> 48:47.940 So, that's my presentation. 48:47.940 --> 48:51.200 And remember, it's always DNS. 48:51.240 --> 48:52.420 Always. 48:54.180 --> 48:57.880 I will be making this slide deck available for download. 48:57.880 --> 49:03.940 There is a whole bunch of bibliography, about five pages of interesting links. 49:03.940 --> 49:10.160 If you are at all interested in this sort of topic, I recommend that you read much further. 49:10.400 --> 49:22.340 Also, there are various folks in the DNS community, the true legends, like Paul Vixie, who is one of the original authors of Bind, and he's been doing DNS for decades. 49:22.500 --> 49:25.540 And Bert Hubert of PowerDNS. 49:25.680 --> 49:31.380 Those guys have many wonderful talks available on YouTube. 49:31.520 --> 49:34.640 And they are the real experts. 49:34.640 --> 49:39.360 I'm just the guy doing some research bringing it to you folks. 49:41.420 --> 49:43.300 Jim, thank you so much. 49:43.300 --> 49:44.040 That was amazing.