Alpha Team Research: DNS Over HTTPS (DoH) Case Study

DNS Over HTTPS (DoH) has been a hot topic since the inception of the RFC 8484 in 2018. The goal of DoH, as well as general DNS over TLS (DoT), is to help provide a layer of privacy for end-users who want to prevent the monitoring of traffic, especially in an environment where privacy concerns are a lot higher. Firefox and Chrome both recently shipped support for DoH, and they both connect to Cloudflare which is running their implementation of a DoH tunnel, cloudflared. Network defenders are worried about this implementation, as it has been used by miscreants and malware authors to bypass DNS monitoring altogether.

Recommendations

Continue monitoring the Alpha Team page on your ZeroFOX Platform for updates on DoH related malware
Update network and host signature detections with malware that abuses DoH

Details

A fantastic report released by SANS on September 10 outlines the history of DoH, its use as malware, some open source projects and outlines a number of experiments ran with the protocol.

The earliest report of a malware family using DoH is the Godlua backdoor. This malware exploited CVE-2019-3396 in Atlassian's Confluence Server to gain access. Once exploited, the malware used a lightweight Lua-based RAT to connect to its command and control server with the DoH protocol. Only 2 types of commands were implemented in the Linux variant, which was running custom files and executing Linux commands. Another attack using DoH was found by MyOnlineSecurity, where a malware sample used DoH to retrieve a TXT record that was a Base64 encoded URL used to retrieve a spam webpage. In both cases, the implication of DoH in an environment demonstrates the classic conundrum of security versus privacy and how both can be at odds with each other.

For detection, the researcher suggested a few methods. First, TLS inspection would be the easiest way to find DoH, but it comes with a cost of implementation and maintenance. Next, using traditional IDS technologies such as Zeek or Snort, one can write rules that detect whether a machine is connecting to websites that have not had a previous DNS resolution, as this can tip off a DoH C2 tunnel. Application logging can help here as well, but only tell part of the picture as opposed to the 2 previously described methods.

One of the easiest methods in the paper for blocking DoH is to blacklist known DoH servers in your organization's infrastructure, which at the time of this writing is Google and Cloudflare. The problem here is that malware authors can use open source tools such as cloudflared to make their own DoH server, rendering this mitigation method ineffective.