Summary of DNS Over HTTPS Abuse

descriptionPublicationkeyboard_double_arrow_right Article 01 Jan 2022Publisher:Institute of Electrical and Electronics Engineers (IEEE)Journal:IEEE Access, volume 10, pages 54,668-54,680 (eissn: 2169-3536,

Copyright policy )Funded by:EC | SAPPAN

Authors: Karel Hynek; Dmitrii Vekshin; Jan Luxemburk; Tomás Cejka; Armin Wasicek;

doi: 10.1109/access.2022.3175497

Summary of DNS Over HTTPS Abuse

- Summary
- Subjects
- Related research
  (3)
- Metrics

Abstract

The Internet Engineering Task Force adopted the DNS over HTTPS protocol in 2018 to remediate privacy issues regarding the plain text transmission of the DNS protocol. According to our observations and the analysis described in this paper, protecting DNS queries using HTTPS entails security threats. This paper surveys DoH related research works and analyzes malicious and unwanted activities that leverage DNS over HTTPS and can be currently observed in the wild. Additionally, we describe three real-world abuse scenarios observed in the web environment that reveal how service providers intentionally use DNS over HTTPS to violate policies. Last but not least, we identified several research challenges that we consider important for future security research.

Related Organizations

Czech Education and Scientific Net work
Czech Republic
Czech Technical University in Prague
Czech Republic

Keywords

Detection, IP flow, malware, hidden communication, network traffic, Electrical engineering. Electronics. Nuclear engineering, DNS over HTTPS, TK1-9971

3 Research products, page 1 of 1

Impact byBIP!

	selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	18
	popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.	Top 10%
	influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	Top 10%
	impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.	Top 10%