Navigating the DNS “Dark Matter”
In Episode 023 of The Defender’s Log, host David Redekop joins experts John Todd (Quad9), Andrew Campling (419 Consulting), and Andreas Taudte (EfficientIP) to dissect the invisible battleground of the internet: DNS.
The Visibility Crisis
The panel highlights a staggering reality—the “dark matter” of malicious domains is not shrinking. Despite blocking hundreds of millions of threats daily, new malicious infrastructure appears at a rate that suggests attackers are pivoting faster than ever, often using domains for less than an hour before discarding them.
Privacy vs. Security: The Great Tension
A central theme was the paradox of encryption. While protocols like DoH (DNS over HTTPS) and ECH (Encrypted Client Hello) protect user privacy from third-party snooping, they create dangerous “blind spots” for enterprise security. Campling notes that by making traffic invisible to defenders, we inadvertently create “playgrounds” for malware and predators.
The Rise of Zero Trust DNS
The consensus? Security must move closer to the endpoint.
- Zero Trust: “Don’t talk to strangers” is becoming a mandatory model for IoT and enterprise networks.
- AI Acceleration: AI is lowering the barrier for “Script Kiddies” to execute complex attack chains, though it also offers defenders new ways to spot anomalies in massive datasets.
The Bottom Line: As the internet’s control plane, DNS is no longer just a “phonebook”—it is the primary lever for securing our digital future against an increasingly creative adversary.
Full episode of The Defender’s Log here:
TL;DR
DNS Security Insights
- Persistent Threats: Malicious domains are growing; new threats appear faster than they can be indexed.
- Disposable Attacks: Hackers use domains for under an hour, rendering traditional blacklists obsolete.
- Privacy Paradox: Encryption (DoH/ECH) protects users but blinds enterprise security to hidden malware.
- Zero Trust DNS: “Don’t talk to strangers”—blocking unknown domains is now essential for IoT and corporate safety.
- Evasion Tactics: Attackers “front” malicious traffic through trusted sites (e.g., Google) to bypass filters.
- AI Weaponization: AI allows novice hackers to launch complex attacks at massive scale.
- The Bottom Line: DNS is the internet’s control plane; if you don’t secure it, you don’t secure the network.
Links
View it on YouTube: https://www.youtube.com/watch?v=XoUn-zWUgWI
Listen to the episode on your favourite podcast platform:
Spotify
https://open.spotify.com/episode/6lZnlMzZY5QzoKYp5S2czD
ADAMnetworks
https://adamnet.works
Full Transcript - The Defender’s Log Special Episode Ep 023
John Todd: There’s this huge mass that we don’t understand quite the size of it that’s out but it doesn’t seem to be decreasing.
Andrew Campling: If I was a CTO, I’d be crazy not to have a Zero Trust DNS model given the risk that I’m exposed to.
Andreas Taudte: If you really would like to understand what is happening in your network, this type of DNS extension has to be within your control.
Andrew Campling: We have a blind spot when it comes to privacy where we try to solve problems with technology. We’re causing other problems because of that.
David Redekop: Every single time we develop something new on the internet, it’s like a whole new layer of problems that we’re creating thinking we’re solving the previous one.
Andreas Taudte: The attackers became very creative.
David Redekop: The amount of domain names shared in infrastructure is over 80 million.
And any piece of malware would be dumb not to use it.
Introduction
Announcer: Deep in the digital shadows, where threats hide behind any random byte, a fearless crew of cybersecurity warriors guards the line between chaos and order. Their epic battles? Rarely spoken of until today. Welcome to the Defender’s Log, where we crack open the secrets of top security chiefs, CISOs, and architects who’ve faced the abyss and won. Here’s your host, David Redekop
David Redekop: Well, guys, DNS-OARC has been kind enough to let us use this space here today for a special , podcast edition of the Defenders Log, so thank you for being available. It’s always good to connect with like-minded individuals for whom DNS is almost part of our DNA , makeup and what we do.
So I appreciate all of you guys and the role that you’ve played in the DNS world to date. And, I wanna start with you, John, because on the way, here this morning, we were talking about not knowing how bad the bad is.
Quantifying the Bad
John Todd: Yeah. Well, and that’s, that’s always the question. Both quantifying the bad and understanding how much of the bad there, is a challenging thing.
So what we, you know, Quad9, blocks a whole bunch of things every day. We know hundreds of millions. We put that on our website. And what I’m always both surprised and disheartened, I guess, is the wrong term, but I’m always surprised at seeing is when we bring a new threat provider on, they’re almost always a very large proportion of that threat provider’s data, the new, those new domains they give us, that we’ve never seen from anybody else.
So they’re unique, and that means that , there’s sort of an incremental, we’ve got 35 different providers, 36 or something like that, different providers, and most of them are very unique with the data that they bring us. And so I was talking with the folks from DomainTools the other day, and it was kind of one of our checkup calls.
And, you know, the term I used with them is like,there’s this enormous amount of, they bring a bunch of unique domains. Everyone else brings a bunch of unique domains. So that means we’re all chewing away, or they’re all chewing away at this mass of dark matter that we don’t understand how big it is, but it seems to be not infinite, but it’s, you know, it’s very large.
And these are just DNS-based threats. I mean, we’re not even looking at the, the more, you know, peeling the onion and looking at application layer and URL based things. This is just the DNS threats. So there’s a, there’s this huge mass that we don’t understand quite the size of it that’s out there. But it seems to be we’re picking away at it, but it does seem to be fairly large because we haven’t seen a decrease in the number of unique names as we’ve added more and more threat providers.
David Redekop: And the trending over time, if you take a look at the last 10 years, it doesn’t seem like this industry is getting less fragmented.
It seems like it’s still growing, When brand-new guys that we all know are like, “You know what? I’m gonna start a threat feed,” and a couple months later, they’ve got a threat feed that you tell us is quite unique.
John Todd: Yeah. Yeah. So it’s worrisome. As I said, we are picking away at it but it doesn’t seem to be decreasing the number of bad things out there.
Allow Listing and Zero Trust DNS Models
David Redekop: So I know you did not mean to accidentally suggest that we go the allow listing route.
John Todd: No.
David Redekop: Because there are some contexts where that is not appropriate, especially in a large-scale operation like you have at Quad9. But it seems to us the closer you get to the endpoint of a group of endpoints, the more practical it becomes.
John Todd: Yeah, and I think we talked about that a little bit, and I’d suggest that the corollary is that the less cost there is for the administrator of the list to talk to the end user, who’s actually being protected, then that becomes more reasonable. But the further away you get then the less feasible that becomes just because like in a public resolver like Quad9, it’s just not possible to have a disallow or you know, allow-only , model , unless, you’re I mean, you can do it, it’s just you’re gonna in a world of hurt if you’re the local administrator of the Yes of the network.
David Redekop: What’s your view on that Andrew?
Andrew Campling: Um, I think there’s certainly a case to effectively use the public resolver. In the case of say Quad9 other public resolvers are available with more of a protective DNS model. But then, yeah, absolutely, for an enterprise , or indeed in a home environment, I absolutely think you’d, well, if I was a CTO, I think I’d be crazy not to have a Zero Trust DNS model, given the risk that I’m exposed to and I increasingly think there’s a valid case for doing that in a home environment. To give you a different measure of bad, a non-DNS measure, but I think it’s equally valid certainly for a home environment wearing my sort of trustee of the Internet Watch Foundation hat our teams - we get reports, I think about 8,000 reports a week of potential bad sites. And roughly three quarters of those, so roughly speaking, about 6,000 are when our analysts look at them, that they are proven to be bad sites.
And that has grown year on year. I think the only limiting factor is how we can scale our search efforts and we’re looking at other ways to do that.
We’ll never use things like AI to do the classification, because you’re making a determination that something is potentially criminal content. Right. So you need humans in the loop for that piece. And that’s really only scratching the surface because we know from reports from organizations like Childlight, their research tells us there’s about, what is it, 400 million, I think , children who have suffered from child sex abuse and exploitation in a year.
It’s about 14% of the world’s children. Not all of that comes into CSAM, but a lot does. So even just that sliver of the bad stuff is very large and growing. So when you add that to all the other bad stuff that we can no doubt talk about as well, Yeah it’s a big challenge, which is why I think as I say, definitely for the enterprise environment, in reality, if I had young children, I’d want the same in a home environment.
Default Protection on the Internet
David Redekop: And it’s not the default. It’s not the default today when you buy an internet connection for a home for there to be filtering in most jurisdictions. I believe- Yeah, in the UK you have some.
Andrew Campling: Yeah. Uh, you yes, when, , Part of the sign-up process, Right that can be, that is for, I think, the big ISPs in the UK, I believe they all will switch it on by default. You can opt out as your activation account, but if you don’t opt out, it’s enabled. But,yeah, you’re right. In a lot of jurisdictions, that’s not the case. And to be fair, thinking of some of the open resolvers, their default options don’t have any protection from any of the bad stuff. Which I find appalling.
David Redekop: Right.
Andrew Campling: I think that’s a really bad choice. That, I know Quad9, you can opt out of the protection, but you have to move away from the Quad9 address to get that. In my view, all of the open resolvers should have that as their default option.
David Redekop: Right. Last week, I remember there being a very popular blog article that 10 years ago you would have never seen, and it said, “Stop using 1.1.1.1.”
Andrew Campling: Yeah.
David Redekop: That was literally the headline for it. And, , it was on a bunch of podcasts where it was featured with the basic premise that if you don’t use that initial obvious layer of protection, at the very least use a protective resolver.
Andrew Campling: Yeah. Well, I do understand why, well, I’ve said this to people at Cloudflare, so they know my views, but yeah, Quad1 should absolutely at least block malicious content.
I see no value in it not doing that. There’s very few people that have any use for, to be able to access malicious content you know, outside of researchers, um, et cetera. So why wouldn’t you?
John Todd: Well, I think, I think the, the question is you need to give people choice. Like Quad9, when we started 10 years ago the concept was that most people don’t understand enough about this so that, you know, the most easily memorable number we’ll put the protection on. We give them choice, so they can use 9.9.9.10 if they don’t want a malicious filter, and there are actually quite a few places that don’t for a variety of reasons. Some of them are actually fairly good technical reasons. Other, you know, customer support, as an example, in some places, some small ISPs or networks, they choose not to use the protective layer because it’s not their system. And so therefore, they can’t, they can’t manage it. So they just opt for 9.9.9.10. So okay, great. But give them the choice, I think, is the answer. And the default, you’re right, I think the default should be protecting against at least malicious sites. I think that I haven’t met anyone who said, “I would really like my system to be infected with malware.”
I’ve never met anyone for that. And I’ve, I’ve met other people who say that they do or don’t want various other content filtering.
But never met anyone who wants their systems infected. So yeah, it seems like that as a default is a reasonable thing.
Visibility, Encrypted DNS, and the Enterprise
Andreas Taudte: There’s one thing that is actually a little bit missing and I remember we have been in conversations with an automotive organization a long time ago.
Of course, at home with, I would say, my family, I just tell them, “Use this resolver,” and then most of the crap gets filtered. And then, which even means that I’d have less support cases to solve within my family.
There’s a benefit for me as well. But when you’re talking with enterprises typically wearing the enterprise DNS hat, because this is where I grew up in the DNS industry, they would like to have some type of dashboard, report, lists, what happened or what was actually blocked.
And that’s a conversation we had, I don’t know, many years ago, that a huge corporation, they could just send everything to Quad9, for example, and then most of the stuff gets filtered. But they have some requirements and sometimes even regulations that they have to have a clue to what was blocked or when, when some kind of malware affect a device and when they are tracing this back, it would be a problem when they see, okay, it’s, it was not able to resolve something. But what was the client that actually tried to resolve it? And if this information is not available that’s critical for enterprises. It’s the same topic with encrypted DNS. There are a bunch of public resolvers available out there that provide that. Even in some local ISPs in some countries.
Some ISPs in my country, they just support it and it’s not a default. You have to opt in for that, but they have that. But this is still outside of the enterprise network. And if you really would like to analyze your traffic, if you really would like to understand what is happening in your network, this type of, let’s say, DNS extension has to be within your control, which means you have to run a DoH, DoT, DoQ server or you maybe have to have some filters running.
And then you have to ensure that actually every single DNS query within your organization is actually using these ones.
John Todd: Yes.
And it’s easy to block 53. It’s easy to block, what is the other one? 853, I guess. But there are some ports, you can’t really block them, and even if you try to block them, it can happen that you’re actually not able to visit any websites anymore because the DNS service and the web service is co-located. If you block this specific resolver over HTTPS, or DOH, in that case, even if you use another DNS server for resolving, you can’t access the website anymore.
Security vs. Encryption & Privacy Rights
Andrew Campling: And, dare I say, that’s an excellent illustration. I think why some of the developments over the last decade or so in the DNS, ecosystem, let’s say, to broaden it beyond purely the DNS, I think to me demonstrates that the standards bodies, specifically IETF in the case of the sort of the DNS stuff, don’t really understand security, or rather conflate security with encryption and I think that’s doing a grave disservice to the internet.
And we get hung up on things like privacy and so on, and ignore the fact that if you weaken security, you’re actually trashing everyone’s privacy, but they don’t know it.
David Redekop: Yes.
Andrew Campling: And increasingly some of the developments , maybe we get onto this, make the software look, much like malware in a lot of its behaviors because it’s obfuscating what it’s doing. It’s impossible to see what’s being exfiltrated from your systems. As you say, Andreas, certainly in a lot of regulated industries, they have to know, and if they don’t know, they get fined. And there was an example, it was about three years ago now, where 10 companies in the finance sector were each fined $200 million because they didn’t have a perfect audit trail of all their inbound and outbound communications.
And in wholesale finance sort area, that means that there could be insider trading and there’d be no way to track it. So there was no proof that there was, but the regulator, I think it was in the US, I would swear to that, found, just hit them all with a $200 million fine which is a big lesson.
John Todd: So I’ll provide a counter to that. I’m actually more in favor of things than you might imagine. Personally, I am not in favor of DoH using 443, right? Because it does conflate signaling and content in the same thing, but that was an intentional decision.
And the group’s consensus at the IETF was that was okay. I don’t particularly like that because I like having signaling and content on different ports, but that’s where we went. And the argument is that actually protection and/or security and privacy are different things, and that the enterprise is actually only a small part of the internet, right?
And so I know that’s a huge problem for enterprise, and it may be the case that DoH and DoHTTP3 and others drive enterprise to breaking end-to-end, internet entirely, so that there is no, there is no possibility of someone in the enterprise connecting to the outside world without going through a proxy.
That seems to be a case that is, you can draw a box around rather well because there are actually companies that are really interested in doing that, and companies already have requirements for understanding where people are going and what they’re doing. So you could argue that that privacy model is already broken, that that’s an expected violation of privacy, that a business understands what they’re doing on their own network.
Where I disagree is that on the global internet, what DoH and other encrypted policies do is they provide a way for individuals in a much larger context, in a national context, to be able to access information freely that they would not be able to. And there are much larger meta arguments that, well, if a government says that you shouldn’t be able to access some content, then the government should be able to control that.
And the general thesis of the folks that build standards, and sort of mine included, are that no, that’s actually not something that should be allowed. And the UN, sort of, depending on how you read the statutes, sort of agrees with that as well.
John Todd: So it’s an extremely gray area. But I think that breaking end-to-end for enterprise users is more acceptable than essentially breaking end-to-end for the whole internet
Andrew Campling: So that’s really important. I think absolutely for the enterprise, if I’m an employee, I’ve signed up for that, I don’t really have an argument.
John Tood: Or a parent even.
Andrew Campling: Yeah. Same for a parent. Where I think it gets more challenging is with the whole sort of end-to-end model, end-to-end encryption, et cetera, is whose privacy are you protecting and at the expense of what other rights? And I think, the challenge is, and again, I wear my IWF hat, because it’s kind of helpful as the counter.
In order to give, I’ll exaggerate this to make the point, you know, bunches of sort of largely privileged adult’s privacy we’re trashing the privacy of children and other vulnerable groups. Because the same technology that means that, you know, no one can read the email I send to my friend, which has probably got nothing interesting in any way, is also absolutely being used by predators to target children literally in their bedrooms.
And the same arguments about not wanting to break privacy are then used to justify why we shouldn’t be able to deploy tools which can easily stop a lot of that. Because for example, end-to-end encryption on messaging platforms, it’s trivial to stop those messaging platforms being used to share known CSAM content.
In my view, it doesn’t have any impact on privacy. It doesn’t break the encryption. Use client-side scanning to see before I upload an image, is it a known bad image? You know, it’s just maths, so you don’t know what the image is. You just know it’s not a match with any of the known bad images that then it gets sent.
Yet we know, again, the research is out there that predators prefer to use WhatsApp, Telegram, and Signal to share their stuff, and they also use that same technology to actually blackmail children into giving them more stuff.
So that, and I say that a lot of that is easily preventable, but the privacy arguments are used to justify why we shouldn’t stop that.
And, I think, they’re, you know, they’re false arguments. They’re not technologically robust. And also, you know, as a reminder, if we talk about the UN, privacy is a qualified right, versus a lot of the other human rights, which are absolute rights. And quite often, the technology trashes the other rights.
And that’s, I think to me, the core issue. And yeah, it’s reasonable to look at a balance of rights, but sometimes people use privacy as a bludgeon to overcome all of the other rights, even if the, the impact of those rights, and, you know, right to life, for example to my mind is rather more important than right to privacy.
Andreas Taudte: Yeah. This reminds me of a conversation we had yesterday during a coffee break. We were just discussing enterprise environments and your private life and the argument was, like, you signed an agreement, so when you are in the corporate network, you are somehow losing parts of your privacy because you are in an organizational environment.
Which is correct but just because I enter the building of the office doesn’t mean that I’m suddenly no longer a husband or a father. Which means it’s not like that I’m entering the office, and for eight hours I will just be a robot working on something. I would like to when I get a message from my wife that something at home isn’t working, that I just connect to her VPN, or then I just double-check something or if I log into a bank account to see why her card isn’t working or something like that.
So I’m at the office and I’m paid to work eight hours straight, but if we are honest we don’t do that. It’s not like that you start at 8:00 and you finish at 5:00, and you never think about anything private during that period of time. So the argument was that there you use a private laptop and you use a company laptop and the same for your phone and stuff like that.
But we are human beings, and it’s not like we can switch from one environment to another like nothing.
You’re still a human being. You still have responsibilities. You still have feelings or opinions and stuff like that. So that’s a challenging one to just say, “So you’re in the office, and now you have to work like a robot.” This is not going to work.
Andrew Campling: Well, and ironically, again, using one of the more recent developments, Encrypted Client Hello as an extension to TLS 1.3 makes that problem worse. Because prior to that you could use a proxy and selective decrypt. So you could say okay its, in sort of speech terms, you know, the software would work out that you’re going to a bank account.
It doesn’t need to look any further.
Andreas Taudte: Yeah.
Andrew Campling: Because of where ECH is deployed, you can’t tell that, so you have to decrypt everything. So ironically, that’s a great example where something that was developed because of privacy by people that I think don’t fully understand security systems. Didn’t think through the implications of in order to overcome that, you know, for the regulated sort of enterprise like a bank, they will have to decrypt everything you do.
Whereas in the past, they would’ve known, oh, you’re going to that thing. We don’t need to know any further. That you’re going to Facebook for the sake of argument. We can now ignore the rest of this stream. They say, “Okay, well, we don’t know, so we’re gonna have to look at every single thing.”
John Todd: I would argue that understanding that someone’s looking at every single thing is better than having a selective model where you don’t know what people are looking at.
Andrew Campling: Yeah. Of course, the counter to that sort of make the privacy argument for the case is, you know, it’s the chilling effect.
John Todd: But the chilling effect happens whether you know that everyone’s looking at every single thing or whether they’re selectively looking at things.
Andrew Campling: Yes.
John Todd:. The chilling effect is exactly adaptable.
Andrew Campling: So this is more honest. I have written a paper for transparency, which is the counter to that which is the potential damage of absolute privacy and absolute anonymity. I would put forward a case for the prosecution of the darknet. Do we really want that as the default? And I don’t think that’s a healthy place to get to personally.
David Redekop: That reminds me of Moxie Marlinspike. Around the time that he developed Signal, he said, “In order for us to have our liberties, it must be possible for us to commit a crime and get away with it.” And it really made me think about that concept over and over again. Does it really have to be? Possible?
Andrew Campling: But you don’t necessarily leave the vault wide open.
**David Redekop:**And I keep on coming back to that answer that, yes, it has to be, but, you know, to the inventor of the hammer, everything looks like a nail. So to the people who promoted ECH, they were looking at this world from a sphere with a very specific lens that kind of ignores some of the other real issues. And that’s why those of us in the enterprise that see ECH being deployed, we’re like, “This is not good for our use case for security.”
Andrew Campling: Or schools., And also let’s be honest, a lot of these developments, they’re not really privacy anyway. That they stop third parties observing the traffic, but actually the place where it terminates, so the case of a resolver, the resolver operator, the case of ECH, the host provider, etc., Yep, they get to see what’s happening.
John Todd: Yeah, that’s a question of trust, though.
Andrew Campling: Well it is, but I think it’s just how it’s promoted by some. There’s a risk, again, it’s your point about if you know that you could be observed, that’s fine.
John Todd: But you choose who you trust.
Andrew Campling: Yes.
John Todd: Ultimately as a question for me is that you need to move this monitoring and measurement and privacy violation out of the network and into the device. And at the enterprise, basically the enterprise controls the device, they control the networks, they control both, so great. But moving it, you need to move the control points closer and closer to the end user.
Andrew Campling: But then that does put more of a burden on the user. So again, go back to my example of the home. The people here will be fine with that. The 99.9% of the population that have never heard of the DNS have no idea how the internet works.
You know, they’re the ones that are actually paying the price of this, because they don’t have the knowledge, the literacy, and so on. I think that’s a major problem.
Enterprise Segmentation and the Edge
Andreas Taudte: And even within enterprises, it’s not that easy. When you look at DNS as an enterprise, it’s not the DNS in enterprise. You have different flavors of environments that need different levels of privacy, different levels of protection. So if I just take my company as an example, there is a research and development team. They have to access certain areas for research.
But at the same time, they have to be protected.
And it’s not like the same approach would work for the team that is doing accounting or HR. And somebody in my network, he’s working for an organization that is responsible for the IT infrastructure of schools in a city in Germany. And they are struggling with various DNS filters because they have to differentiate between the students and the teachers, because the teachers have to access different places that the students are not allowed to.
And it would be a horrible scenario to configure static resolvers on the teachers’ devices and all the rest get their address by DHCP or SLAC or whatever. So this is, actually coming back to your point and bringing it closer to the device is one option, if the device is able to handle it. If we are talking about tablets and laptops, that’s fine.
But if we think about stuff like OT and all these IoT devices and stuff like that. There is absolutely no chance to teach these things something.
Andrew Campling: Well and also that’s a reason why you don’t just want to have it on the device because you know, let’s face it, I think there’ll be a talk here at OARC that you know just surfacing some of the security problems with IoT devices.
So actually if you rely purely on the end point for the for sort of protection, you know that is an illustration why that’s not a good model. You know, any good security model will be multilayered to reduce the risk of instance.
Andreas Taudte: Yeah, we were working with an analyst organization recently on the topic how a modern DNS should look like and come up with a paper, a short one, that has some recommendations. And one thing that we just touched briefly because we don’t want to write a book is all these sensors and AI agents out there, they are doing DNS. And if you would like to add stuff like encrypted DNS and DNSSEC validation and stuff like that, try to add this stuff in a sensor that is measuring stuff in a pipe in a factory.
Hmm, That’s a challenge. That’s a challenge. So you can try to bring it closer to the Edge, if the Edge device is capable of handling that.
John Todd: But that Edge device has no brains in it. It only has one task, right? It’s a sensor. It’s an IoT device which has a very limited set of scope. It’s not a human. Because we’re really talking about human constraints versus equipment constraints.
Andreas Taudte: When it gets attacked, when you look at something DNS queries in an enterprise, it’s strange when a camera suddenly tries to resolve a google.com, for example, because that looks like that it was compromised and it’s trying to find a way out.
Andrew Campling: Well, and there are instances to John’s point, where certainly on networks the IoT devices have been the point of attack.
John Todd: Oh, I completely agree. Like, I, actually, this case example, I don’t let my IoT devices talk to the public internet at all. There’s a resolver that they and this is my home network, right? They talk to a local resolver on my local network. It has a limited set of names that it’s able to resolve Then that’s it, and really that’s basically just for time synchronization.
John Todd: So IoT devices have a totally different array of things that they can communicate with, and they are allow-only. And that’s, that’s appropriate. I think what, where the question is when we’re talking about people and what’s the person’s job, right? What does their job allow them to have access to? In an enterprise scope, it’s a limited set of things that they have access to, right?
You’re supposed to be doing work, and you’ve got people that you communicate with, other work industry sites. But if you’re just a person, being a human being, as you said, there’s two different hats we wear at work. There’s the work hat, and there’s just being a human being. Then there’s a different set of things that we have to apply.
And maybe it is the case that people don’t get to communicate with their bank from their home office. I mean, even this device, right? If I bring a phone into work, it’s communicating with a network that isn’t the work network. It’s communicating with an outside network. So there is no control there.
So how do we manage that in an enterprise? But that’s outside of the DNS. That’s basically just how does communication happen in a controlled environment?
In enterprises and schools and at home. Again, I think moving it down into the, closer to the device seems like the right place to do it. Looking at the network is much more challenging.
Andrew Campling: Whereas I think because you go back to the consumer environment, because of the lack of knowledge and skills, doing things that make it hard if not impossible to do it in the network, I think, is a major problem. Because you’re saying, “Okay, you can do it on the endpoint.” Disregarding the fact that the vast majority of the end users have no idea and never will.
John Todd: We’re trying to solve one problem by creating another problem.
Andrew Campling: But going back to the rationale for providing some of these protections is, you know, because of people in, say in countries where they wouldn’t otherwise have access to that information. The usual pushback from technologists, when we talk about societal problems, is those are societal problems, you can’t solve them with technology. We seem to have a blind spot when it comes to privacy.
John Todd: Ultimately, you cannot solve those problems with technology.
Andrew Campling: But we have a, in my view, we have a blind spot when it comes to privacy, where we set that aside and try to solve those problems with technology, completely disregarding the fact that we’re causing other problems because of that.
Complexity of DNS & Zero Trust Expansion
David Redekop: You know, Andrew, every single time we develop something new on the internet, it’s like a whole new layer of problems that we’re solving. Or we’re creating, thinking we’re solving the previous one then we’re creating a new one in its place, right? One of the reasons why I find DNS to be truly interesting, as all of us do, is because we have such a wide array of issues. Like, just think about the last 30 minutes, the wide array of issues we’ve addressed. But they all have a connection back to DNS. Right?
David Redekop: They’re all pointers back somewhere, right? And so this is why we’re all interested in this space. How can we improve that space? So one of the things that we felt was really, really important as a company, when our mission is to protect people, is to apply that as a stronger control, and I think I saw you posted something around a book called DNS: The Internet’s Control Plane.
Andreas Taudte: Yeah, it was something that was recently published.
David Redekop: Right. And that reminded me that Dr. Paul Dixie was talking about DNS being his control plane, like, decades ago, dare I say?
Andrew Campling: That’s probably true.
David Redekop: And yet we are only now finally adding the Zero Trust layer to it, the don’t talk to strangers layers to it that we added in Microsoft with Zero Trust DNS. And I wanna just have the audience hear your perspective. A lot of people know my perspective on it because obviously we feel very strongly about it. In fact, that’s over how we even met in the first place. What are you guys’ thoughts on it? Fight me on it.
Andreas Taudte: Ah I don’t wanna fight about it because the principle behind it’s a great idea. But yesterday somebody who went to the microphone after a talk made a very interesting comment that, especially with regards to the DNS protocol itself, we fixed a lot of things. So stuff like DNSSEC and it’s not encrypted DNS. If I just remember when I was playing around with DNSSEC back in 2010, you still had to run some binaries and to sort the DNS zone and stuff like that.
And nowadays it’s just three lines of commands in a configuration file and then you are done. So we solved a lot of these issues. It’s much easier to have a protective DNS of some flavor. But it’s the organization that is struggling with that, with the skills.
Skills gaps are a major one because it’s not their day-to-day business. Tools and the processes around these tools are the issues that I see very often. And sometimes I would say the local IT guys, they don’t have a choice. Especially, when you are in the manufacturing area.
There’s a supplier, they will ship you something or that is coming on four or five trucks. They put it in your house, and then they connect it to your network, and it has to have internet access for some maintenance reasons, and it’s coming with some overlapping IPv4 addresses. All machines are running on 192.168 networks, and you can’t modify that because it’s somehow hard-coded in the main board of the box, and this machine has to run for the next 25 years.
So they are really struggling to get their hands around these environments, and they try to isolate that. So for example, the plants, they have a different DNS infrastructure compared to the offices, but well, you still have people that are using office clients in the plant. So there are a lot of challenges where it’s something like, yeah, you are close to 90% doing it right, and there are these remaining 10% where you can’t do anything about it, and that’s actually the sweet spot for the attackers.
Even if you are at 99%, if there is something running in your plant, you don’t have a choice. They will find that and they will use this as an attack vector.
David Redekop: Yeah absolutely. I have stories about where we had to architect a VLAN to basically make a static device work that could not be changed. So the whole infrastructure gets changed just for that device to be able to work. And then you have modern-day devices, like certain products made by Google, that will just use quad eight for DNS. And it doesn’t matter if you tell it that you’re giving it the DHCP offer what it’s supposed to have statically assigned, it still goes back to 8.8.8.8.
John Todd: I have, at my house, I have 22 VLANs. Because I isolate, you know, there’s something and just like you said, there’s some things that you just can’t change the IP address on. Well, okay and they overlap with existing networks, and I have to do special NAT to make them work the right way.
And that’s, you know, and there’s no way you can expect a home user to do that. But anyways, so to get back to your original question, I actually really like Zero Trust DNS. I think it’s a great thing, but again, you’re pushing that decision way down into the end user’s side of the house and I think that it works.
I really like the idea for enterprise. I actually even like the idea for home users if it can be done in a way that, again, brings the administrator very close to the end- the user that’s actually being managed, and that works. But the further away you get, the more impossible it becomes.
It makes services like Quad9 or DNS filtering more powerful because it, you know, if we don’t allow it, you’re basically trusting some third party who’s got a bigger list, and you could actually have layers of that. Then, that’s great. I think it’s a good idea if you have a user community that needs to be tightly controlled in some fashion.
I think it’s a wonderful thing, but it remains to be seen if that will work, you know, at I don’t think it’s gonna be very difficult to make that work for home users. I think, it’s actually, it’s gonna see enterprise adoption first but how broadly, I don’t know.
David Redekop: Yeah, I mean, I have sons that have certain proclivities to play video games at times, and video games are very unfriendly, for example, to the concept of don’t talk to strangers.
David Redekop: But most other things have become much more practical I would say.
Extended DNS Errors (EDE) and Visibility
David Redekop: But I wanna point out, bring back another comment before that you made, Andreas, about logging of DNS. So when you combine the two, you can basically eliminate all of the chaos in the data and bring out pure signal so that every single connection can be made. And so for us, when we show that to a SOC or to a security team, they look at that and say, “Wow, there is nothing, absolutely nothing about any connection that’s now mysterious. Everything can now be accounted for.” And so that’s something that sometimes gets a little bit lost. And then you, John, were actually the one to suggest some time ago that we implement EDE, extended DNS errors.
And so we do that when we inherit yours and we extended that internally. And so you can now combine the EDE from Quad9 with EDE of a protective resolver on premise, and still be able to have a very rich data set on all of the telemetry that you’d want. Why was this blocked in the enterprise?
Andrew Campling: And do you structure the error messages, or are you planning to go there next as an extension to
John Todd: There’s a text option in EDE.
Andrew Campling: Is that what you’re talking about? Where you can give more meaningful explanation.
David Redekop: We use that quite extensively, and it turns out that was a real golden nugget from John when he initially suggested it. I think it was before it was even quite a standard.
John Todd: It was, we made some comments on the draft at some point. But yeah, that, being able to extend it with essentially free-form text is really useful. You gotta be careful with that though, because free-form text becomes structured text.And then you know, are you gonna put JSON in that text pod?
Andrew Campling: Well, that is a thing.
John Todd: That’s why I’m saying, like, it’s just where you decide you’re gonna make your structure omit. But, I think that’s really useful. And I’m really happy we’re finally doing EDE with the right messages in it, and you can stack those, so you can have three or four messages in the same, that actually gets back to your comment earlier about understanding whether, you know, the enterprise needs to understand exactly what happened. And you can now add the exactly what happened messages to DNS to some degree. I mean, there’s a limit, right? You at least you can put a pointer in there that says, “Go here for more information about what happened.” So that’s really interesting. We’ve been from since we started, we’ve actually been tagging all of our block messages. We set the recursion available bits as zero on blocks that were from our block list rather than natural NX domains. So, we’ve always signaled it, but only a few people have actually ever figured out how to take that data and make anything out of it. Pi-Hole, I think, has a flag in it. But now EDE, we can kind of get rid of the proprietary way of doing it
Andreas Taudte: I remember you gave me this command line back then. Yes. How to do that, because EDE was not available back
John Todd: You can use Wireshark and you can look at the DNS list and pick out the ones that are natural and unnatural blocks.
Andreas Taudte: I’m just thinking about how I can explain this to my mother so that she can have a look at it.
John Todd: Well that’s another question about how you surface bad things to the end user is a big question.
.
Andreas Taudte: And if you even should, because people are scared of everything so for example, when we had this little outage in Germany. We may have heard about it. Not sure if it made it into the news. There were actually people really just, coming up with ideas that Germany was just attacked by some regime or something like that.
No, it was just a DNS configuration issue. Because everything in the news is scaring people at the moment, so if you surface something in their browser, “Oh, you wanted to go to this website, and we blocked you,” they just think they have to go to jail right now.
John Todd: Well, I mean, it, again, it’s giving, kind of, users choice and giving them visibility. So I’m a big fan of giving users the ability to see things. I agree that’s going to increase your service load if you’re an enterprise or you’re a home user, right? Like, why did I just get this message that says I was blocked? But the opposite of not, you know, not doing that is, like, I can’t get to the site.
Like, why am I not able to go to the site? The internet’s broken. I’m gonna call the support desk. I can’t get to, you know, Google with five O’s. So there’s a balance there.
David Redekop: I think they have a forwarder for five O’s now. I remember one time, I wonder how many O’s did they protect in their domain names, and they actually went quite far.
John Todd: There’s actually a malicious domain that we’ve had on our list for years now that’s something like 15 or 20 O’s.
David Redekop: Oh no
John Todd: And I don’t know what they’re doing, but it’s just this massively long name that like, because I’ll scroll. I just look at the blocked domains sometimes, and suddenly there’s this one name that just, like stretches across the entire screen. Like, oh, they’re still there. That’s interesting. But, yeah, it’s, like, visibility is a big question. And that moves up into the browser folks world, and, like, what do they surface, and what do they not surface?
Malicious Domains and Threat Intelligence
Andreas Taudte: Yeah, this thing, so to look at the domain and realize, okay, this is something strange, obviously, this is a real challenging thing. So I had an opportunity to talk with some of our guys from the R&D team, and they have to come up with fancy ideas how to spot things that are not obvious but still kind of malicious. And the attackers became very creative, I would say. So what it just, I guess earlier this year, we released our very first threat report.
So we are doing this now as well. And a colleague of mine, she summarized it quite interestingly that the attackers realize when they purchase a bunch of domains, and then they start an attack. This is visible quite easily. But what we realize is that they register a bunch of domains, and then they sit there for various weeks, for example.
Because we have these new registered, new observed domain things. So, they just try to stay under the radar. So just because something was registered half a year ago doesn’t mean that it’s a nice website of a coffee shop. It can be used as an attack. And when I saw the data, I was just asking the team, “Can we just do some research about the time between these huge chunks of domains get registered till they are actually used for an attack?”
Not sure if they digged into this already, but it’s quite interesting to what you, what these guys are able to see in DNS, which is not obvious because you can’t really see it.
Andrew Campling: Yeah. I know there’s a fair amount of research which shows domains deliberately being used for malicious reasons, whatever, either they use more or less instantly, so the preferences of attackers are either to use them within the first few minutes.
There’s some good research from one of the speakers here RAFFAELE SOMMESE which, I think, it shows that the domain is registered abused and discarded for phishing within an hour. So that by the time it shows up on a lot of the reports as registered in the last 24 hours, it’s already been binned.
But then the other extreme, you then have the so-called aged sort of domains either they’ve been just left but in the cupboard for however long or they’ve been purchased from probably legitimate users because they become sort of free. And again, they have whole sort of warehouses, you know, virtual warehouses of those to then use.
John Todd: We actually give RAFFAELE some of the newly observed domain data. So in fact, what happens is a domain will get registered, it will get used for an hour and then it will get canceled because the registrar will be like, “Aha, you’re doing something bad.” But that name is still in the cache. So if it’s been looked up by a large resolver, and they’ll have, like, a 12-hour cache.
So it’s still active. And then so what he’s doing is he’s actually feeding back the list of things that appear and then disappear really quickly. He’s giving that to us as a block list. So that’s actually really, really useful, because then we actually start to block things, even though they might still be in our cache or anybody’s cache.
But getting to the, you know, the, yes, they think, people are now leaving domains to season. That’s an old technique. And we actually have visibility onto that as well. So we see, and we can create like a stacked ordinal list of all of the domains that we see on the internet that are queried in a day.
We just basically create like, this, you know, Google’s typically, Google or Apple are number one, and then we go down from that, you know, to the eighth millionth place, right? So, but you can watch as a domain, if a domain is in the very long end of the tail where there’s almost no traffic, and then suddenly it starts moving up very quickly, you know, in a matter of hours, where it’s, you know, moves from five millionth place to two millionth place, all right, that’s interesting. That domain is now active. It’s starting to be used. And you can use that as a signal. And that’s where, you know, threat intelligence providers can work with the DNS to kind of find those things. But it’s hard. It’s a very hard thing to do, and then
David Redekop: And you need the scale of you to be able to make that super meaningful. Right? So basically, ranking on the popularity is a really good signal because it defeats the purposeful aging of a domain.
John Todd: But it’s still, I mean, legitimate domains also fall into that same category, right?
So you have, you can’t just use velocity as a single trigger.
Andrew Campling: Interesting presentation at the last ICANN contracted parties meeting from the ICANN team. They did some research on this, where they showed parked domains being very popular.
David Redekop: Right.
Andrew Campling: But they’re used very cleverly to try and bypass some of the threat detection by effectively fronting onto some of the traffic distribution systems.
So probably 90% of the traffic that lands on those parked domains then gets rerouted off to completely harmless other destinations. But if you land at a particular time of day or from a particular part of the world there’s probably three or four different things that have to coincide, then you several hops later, you end up at something bad.
But again, they’re trying to obfuscate that by the front door is a sort of parked domain that’s totally benign, and most of the traffic that passes through it is also benign.
John Todd: You start to move away from DNS being the only way you can signal that, or it actually, it’s never the only way, but, you know, we see APT issues where, you know, if you’re querying from Japan, and only from Japan, you get a different A record than you do from the rest of the world. And so we can trigger on that, right, from the DNS perspective. But a lot of times, as you said, there, you know the URL, is basically all URL-driven, so it’s deeper in the URL, and so you get redirected to different content depending where you’re coming from.
It’s not even a DNS question. Yeah. So that’s, that’s the harder problem of, okay, now you have to go deeper into a site to figure out what’s going on, and there has to be a scraper, and that’s a whole different security you know, multi-billion dollar industry that figures those kinds of things out. And hopefully AI will be used, and it is being used appropriately there.
Andreas Taudte: And we are actually looking at stuff like that. So that we have at the moment, we have a list of a couple of hundreds of thousands of websites. Well, it’s actually screenshots of websites. So when we see a website that looks like the website of Quad9, but the domain is not yours, this is a signal for us that maybe somebody is trying to run a phishing campaign.
So you look at logos, you look at fonts and text and stuff like that, and then you try to identify, is this used somewhere else in the namespace that is, that was never used by this or origin
in the past. This is possible. But it’s a lot of effort. And you really have to visit these websites, and then you have to take, of course, it’s not a person that is doing the screenshots. It’s an algorithm that is doing that. But you somehow have to scroll through the entire internet, which is a huge task.
Andrew Campling: Yes.
David Redekop: The malintent is just layered everywhere throughout the internet infrastructure, right? Because a bad guy can think about any number of ways. Like, the amount of redirects, I’ve stopped counting at nine redirects for some of these scams, that go from URL shortener to a website with some JavaScript, and it just bounces, bounces, bounces. And in some ways, it’s like the tables are being turned to become a defender’s advantage. Because the longer the attack chain is, the easier it is to find, to disrupt it at just one spot.
Andreas Taudte: Right. Or maybe it’s just a very, very bad programmer that is hosting a website, using some plugins from some other sources and stuff like that.
John Todd: Well, we’re sort of contributing to the dead internet, right? Like, defenders are to some degree contributing to the dead internet, because you have to look. Everybody’s always looking at all these websites to make sure they’re not hidden bombs. And so, like, now a large part of the web traffic that I see on my personal website is bots scraping for, you know, scripts, bad scripts that are embedded in my website, to see if I am being used as a, as a method for relay.
And I know that those are defensive sites. They’re people that are doing it to see if, you know, they’re just checking, like, making sure. But, you know, now we’re increasing more and more traffic on the internet just to get around problems, and
David Redekop: I mean, Google happily offers you a free redirector. So it’s actually quite trivial for an attacker to even deceive the four of us, because the link in itself will be google.com/amp/ and whatever, right? So we will instantly recognize that clearly is going to Google. We just don’t know where it’s gonna go after that until we attempt it.
The UNDERMINR and Evasion Techniques
David Redekop: So, before we wrap up, I just wanna get your thought on the presentation I did yesterday on the UNDERMINR which is this idea that the deceivers are sitting in the middle between the difference of a DNS lookup and what the SNI or an HTTP header is that used to be thought of as domain fronting.
This is a different kind of an approach because it’s not necessarily always detectable at the content delivery network side, and it’s not easily detected at the source, right? And so it’s become kind of a layer underneath that can be quite deceptive. The concept isn’t new per se, but the way it’s being deployed today at the scale it, is something that was brought to our attention. And the press embargo is over by the time this gets published, so what’s frightening to me was that the amount of domain names that are shared in infrastructure is over 80 million. So we’re talking about an attacker being able to choose any one of 80 million domain names and say, “Hmm, where do I want to set up my C2 infrastructure? Let me pick a CDN and let’s just pick one of the 80 million domain names that has a high rank of trust with all kinds of domain name systems that are tagging or categorizing and that’ll be what I will use to make my connection, but then switch the SNI once the TCP connection is made.”
And so that to us has a very, a long tail effect because the moment this idea makes it into private language models, large language models that are without any guardrails. Then any piece of malware would be dumb not to use it. Because then they can. It’s basically the technique of defense evasion that would be applied and be simple enough to do. So anyway, I would like to get your thoughts on that.
John Todd: So, I mean, as you said, it’s not a new thing. Pointing names at multi-hosting endpoints has been, it’s a well-known evasion technique. I will say it’s sort of my previous comments hold. We’re actually pushing the security model closer into the client, right? The end client needs to understand this, you basically have to get the applications have to be able to be exploded, right? Like, an application should not be able to make connections by itself without having to go through some security intermediary layer.
I don’t know if that exists or how strong that model is in particular in Windows. That’s not my operating system of choice. But you know, the same thing on the Mac. Like, do you allow an application to have unrestricted connections to the network without there being a way to open that up and see, like, what is actually going on in the transaction?
I do think it’s an end device problem that you’ve identified. I don’t think there’s any really. There’s no perfect way of solving it without the end device being involved. There are ways of, there are ways of sort of identifying it with the network layer, but it’s tough. I don’t see an easy solution, I guess the short form.
It’s been around for a while, and it’s gonna continue to happen.
Andrew Campling: Yeah, maybe that highlights, you know, again, my view, a misstep in allowing applications to directly access the DNS. Which bypass user preferences.
John Todd: But the problem is that it’s actually not. It’s actually going through the standard stub.I mean it’s doing a valid DNS request and it’s getting a valid answer back but then it’s connecting to some other object on the, you know, basically at the network layer, you know, at the HTTP layer or even at the IP layer is where the problem is.
I don’t know how to solve for that. The DNS is not involved really.
David Redekop: Yeah, some of the PCAPs that we were looking at were literally showing that it’s connecting to udemy.com, which is a popular educational content website that doesn’t get blocked anywhere. Connects to port 80, but then as soon as that connection is made, then there’s, sometimes there’s no method defined in the HTTP header, and sometimes it’s a content length of non-zero, and then it’s a header within a header within a header, and the CDN just happily accepts it. You know, whatever the final header is, it’s easy to identify with the naked eye that that’s a host header. But it didn’t have a proper method defined. And so you have all of these tricks. You’re like, “Well, if the CDN accepts that mess of embedded headers, then what other methods might there be?”
John Todd: Is this ultimately a problem with V4 being, , you know, only four octets?
David Redekop: You hit the nail on the head because the root of the issue is IPv4 depletion, which caused us to say, “Okay, we’ll just find a way to have multiple domain names point to the same IP address.”
And initially we did it with host headers back in HTTP days, then we added SNI.
Andreas Taudte: But the attack would work in IPv6 as well, I guess.
David Redekop: Well, in IPv6 you don’t have the scarcity problem. You can literally have a dedicated IPv6 address for every single asset. There is no need for sharing IPv4 addresses.
So yes, I hear my IPv6 friends saying, “Hey, see? There’s another reason to switch to IPv6 only.”
Andrew Campling: Some CDNs, for particular reasons, will always share addresses to, as a sort of defense against IP blocking. Because they’re then accused, the blockers, of over-blocking. When in reality, with IPv6, they could totally not do that.
John Todd: But most people still, most meaning probably, well actually, I don’t know what, I don’t know what the ratio is now, but most people still aren’t using V6 for their content delivery. I mean I’m actually not sure about that. Do, I wanna say that I heard that we just reached 50% of something. So you could theoretically start to break it out on a per domain basis, maybe.
Andrew Campling: Yeah. And, dare I say, if we were strict about not abusing SNI, that would help. But of course, again, going back to my bete noire of some of the missteps with ECH. One of the proposed changes is to bring in the ability to randomize the SNI pretty much within the session.
So the SNI becomes a completely meaningless thing to make it harder to block. But that then has consequences if you’re playing around with the SNI, then yeah, that’s an attack vector for other people.
David Redekop: Yeah, privacy and security is like this Venn diagram that’s trying to pull apart, right? Yeah.There’s some overlap in there, where you want the best of both worlds. You want the best of privacy and you want the best of security, and so that tension will stay there indefinitely. For the time being, what we’ve done is we’ve published OUTMINR as a free tool that people can put a network tap close to their edge of their network and identify these. So basically, if there’s an SNI connection that did not have a DNS resolution, then that would be a red flag. And so this is an important mitigation currently because you can actually see the SNI in clear text, right? When you just do the TLS unwrapping without there being any I would say, without there being unreasonable breach of privacy. Because that’s what’s necessary today. As long as we provide that tooling to an attacker then we have to find a way to mitigate it. So that was our position when we took this role of continuing to protect people. And when you think about it, it’s trivial for a click-fix attack to now modify to adopt this technique.
Because then the URL that shows or in inside the PowerShell script that you deceive the user to paste, it would look like it’s going to, you know, udemy.com for example.
Andrew Campling: Yeah, you just know that the sort of malware as a service sort, is now being rapid adoption of.
David Redekop: Right.
Andrew Campling: Yeah.
David Redekop: So given that AI delivered an AI-generated malware is now a reality it’s clear that we have to be at the forefront and think proactively on that.
Andrew Campling: Yeah.
David Redekop: Yeah.
AI’s Impact on the Threat Landscape
Andreas Taudte: There are some things we have to keep in mind, especially with all these AI agents coming around the corner. If you compare the DNS traffic that these boxes create compared to just the user in front of a browser, it’s a completely different level. So for sure there will be some, let’s say, you will be able to measure something on resolvers and authority service as well.
With that regard, I’m not very scared because the amount of queries that we have to answer is increasing since years. So it’s just another tool that is using DNS for that. When it comes to attack vectors and malware and stuff like that, it’s not like that an AI is able to come up with something completely new and execute it.
This is not possible yet. But it’s just the speed. So the attacker with the bright mind that comes up with a clever attack can get it up and running faster. And that’s something that I see. But it’s not like that a script KIDDIE can use an AI, “Please write me an attack,” and then suddenly the AI comes up with something and is actually executing this.
So you still need clever people to actually execute that. But the, let’s say, the entry level of that was getting lower, so it’s easier, but you still need a human being in front of it.
Andrew Campling: Well I’ll be more pessimistic. So, I think, two things on that. First, on the agentic AI, probably will use the DNS as an identifier, which I think is a good thing in principle.
But, again, if I look at some of the current forecasts they say, you know, currently there’s what? 350 million domains ballpark. The projections are that by 2030, there’ll be between one and five billion for agentic AI. Big range. But even if it’s at the one billion, that’s three times more than the current system.
So I think that’s gonna stress test a lot of things and probably break some stuff just because if you triple, quadruple, go to 10 times current volumes in a short space of time, that will surface things, , you know, put systems under strain. Not in terms of the core DNS, but some of the systems that registrars are using, that sort of, you know, the really base, all the other infrastructures.
I think that’s an issue. In terms of the attackers, though, I think, it’s absolutely already the case that some of the, you know, latest systems, Mythos, for example, are coming up with attack chains that your human attackers would never conceive of.
And combining things in really stupid ways or outwardly stupid ways to surface vulnerabilities that, okay, maybe a human would have got to eventually, but they’re getting to them really quickly. And putting access to that at a very low level. So, yes, you may have had your state actors perhaps coming up with that sort of thing, but suddenly it’s giving those vulnerabilities, you know, to the novice attacker.
That’s why I’m pessimistic that I think we’re gonna have the sort of tsunami of vulnerabilities, what we’re already seeing the early wave of that. And it’s gonna overwhelm the defenders because it takes time to assess them, prioritize them, develop fixes. So even though you can find the things, it’s you know, they’ll be exploited for longer perhaps than previously would’ve been the case.
David Redekop: I think we’re gonna have to use the optimist point of view to simulate adversarial behavior with the pessimistic check to make sure we thought of everything, and then validate it with the methodical. You, You have a really good perspective on the trending. That, like, you shared some pretty interesting results when you first enabled DoH. At where it got adopted, at what rate, and so forth.
John Todd: So I’m, I’m interested in how um, AI is being applied to the open source community. That’s something that greatly interests us because we’re all open source based. And so there’s this giant lump of 30 years worth of open source bugs or, you know, some questionable coding that’s just kind of gone under the rug, is now being dragged out, and so we’re seeing the open source community having to deal with the panic of, not script kiddies, I’m not even sure what to call them, CVE kiddies.
That are, like, dragging all the stuff out and trying to get things fixed for whatever reasons. So technical debt is now being swallowed in the course of a year or less, and so there’s a huge, I’ve used the word panic, and everyone said, “No, no, no, we’re not in a panic. We’re just overwhelmed.”
But that, that all needs to get sort of worked out, and so I see that as being an interesting process. And hopefully it’s hardening the DNS and the code that everyone uses across all the different packages. AI and DNS, I don’t see a big, I kind of agree, I don’t see a big change.
I do see a, the script kiddie barrier being lowered, so we’re gonna see a lot more abuse that’s just happening because people who couldn’t figure out how to do the script kiddie scripts now will have an AI to do it for them. So that will increase probably the abuse traffic, but I don’t think it’s gonna increase the effectiveness maybe.
The last thing I’m interested in with AI is that we’re using, you know, DNS as a pointer platform. It’s a way of identifying pointers. So I’m interested to see if at some point in the next couple of years AI starts to try to figure out a way around that. You know, because DNS presents some degree of friction.
There’s the friction of, you know, registering a domain name and then actually doing DNS lookups itself is sort of friction. Will there be a clever way that people start to use AI or AI systems start to work with each other that uses a different pointer system entirely? And that’s worth thinking about and kind of considering, because there are whole new security and other concerns that come up with that.
But it’s not inconceivable that there’s some new better way that this can be done that isn’t the DNS or that uses the DNS as a launch point but then is a, you know, has subsidiary technologies layered on top of it. So I’m really interested to see how that will happen, if it happens. Maybe I’m just being, you know, too starry-eyed at, you know, what AI will think of.
But AI plus smart people is gonna accelerate a lot of things that we don’t expect. And that could be a sort of a black swan that we aren’t looking for.
Andrew Campling: Yeah.
Andreas Taudte: Yeah, this reminds me of a story a long time ago where they just let two AI agents talk to each other, and suddenly they invented a new language. And then they switched them off. Something like that. But so they switch off the communication via DNS and talk, and they just come up with a new protocol. And just use it and so that.
Wrap Up
David Redekop: Guys, this is supposed to be a happy talk. So on that note, before it gets any worse, we’re gonna resume the conference here today. Thank you very much, John Todd, Quad9, appreciate having you here. Thank you, Andrew Campling, 419 Consulting, for your weekly podcast that you do. That’s great and helpful. And Andreas Taudte, EfficientIP. Thank you. Glad to have you here. And see you guys again soon.
Announcer: The Defender’s Log requires more than a conversation. It takes action, research, and collective wisdom. If today’s episode resonated with you, we’d love to hear your insights. Join the conversation and help us shape the future together. We’ll be back with more stories, strategies, and real-world solutions that are making a difference for everyone. In the meantime, be sure to subscribe, rate, write a review, and share it with someone you think would benefit from it, too. Thanks for listening, and we’ll see you on the next episode.