Measuring DNS-over-HTTPS performance around the world

Chhabra, Rishabh; Murley, Paul; Kumar, Deepak; Bailey, Michael; Wang, Gang

doi:10.1145/3487552.3487849

Cited by 20 publications

(16 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…From the above studies, it is quite clear that DNS encryption protocols perform not so well when network conditions are less ideal. This remark has also been drawn from measurement research works done on edge networks [38,46,57,81] (e.g., home) that have substantial distance from the essential Internet infrastructures. By measuring DoH resolution times from 22K unique hosts across the world, the authors of [38] found that hosts in high-income countries/regions with better Internet infrastructure are less likely to have performance degradation.…”

Section: Performance Analysismentioning

confidence: 95%

“…This remark has also been drawn from measurement research works done on edge networks [38,46,57,81] (e.g., home) that have substantial distance from the essential Internet infrastructures. By measuring DoH resolution times from 22K unique hosts across the world, the authors of [38] found that hosts in high-income countries/regions with better Internet infrastructure are less likely to have performance degradation. At the same time, clients from less-developed areas experience a significant slowdown by switching from plaintext DNS to DoH.…”

Section: Performance Analysismentioning

confidence: 95%

See 1 more Smart Citation

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques

Lyu,

Gharakheili,

Sivaraman

2022

Preprint

View full text Add to dashboard Cite

The domain name system (DNS) that maps alphabetic names to numeric Internet Protocol (IP) addresses plays a foundational role for Internet communications. By default, DNS queries and responses are exchanged in unencrypted plaintext, and hence, can be read and/or hijacked by third parties. To protect user privacy, the networking community has proposed standard encryption technologies such as DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ) for DNS communications, enabling clients to perform secure and private domain name lookups. We survey the DNS encryption literature published since 2016, focusing on its current landscape and how it is misused by malware, and highlighting the existing techniques developed to make inferences from encrypted DNS traffic. First, we provide an overview of various standards developed in the space of DNS encryption and their adoption status, performance, benefits, and security issues. Second, we highlight ways that various malware families can exploit DNS encryption to their advantage for botnet communications and/or data exfiltration. Third, we discuss existing inference methods for profiling normal patterns and/or detecting malicious encrypted DNS traffic. Several directions are presented to motivate future research in enhancing the performance and security of DNS encryption.CCS Concepts: • Networks → Application layer protocols; Naming and addressing; • Security and privacy → Security protocols; Malware and its mitigation.

show abstract

Section: Performance Analysismentioning

confidence: 95%

Section: Performance Analysismentioning

confidence: 95%

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques

Lyu,

Gharakheili,

Sivaraman

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…A more extensive study was performed by Chhabra et al [14], who studied DoH performance impact across the world. Their results show that users from higher-income countries with higher quality internet infrastructures are less likely to experience slower performance caused by DoH, resulting in a disproportionate impact on users from countries with lower economic capacity.…”

Section: Related Research On Dohmentioning

confidence: 99%

“…The online casinos are fighting the gambling ban by changing IP addresses and registering multiple domains. We have used the Security Trails Passive DNS system 14 to monitor a domain name of selected online casino IP address. As it can be seen in Figure 2, more then 100 domain names point to the same website according to the Passive DNS data.…”

Section: Novel Observations Of Doh Abusementioning

confidence: 99%

Summary of DNS Over HTTPS Abuse

et al. 2022

View full text Add to dashboard Cite

The Internet Engineering Task Force adopted the DNS over HTTPS protocol in 2018 to remediate privacy issues regarding the plain text transmission of the DNS protocol. According to our observations and the analysis described in this paper, protecting DNS queries using HTTPS entails security threats. This paper surveys DoH related research works and analyzes malicious and unwanted activities that leverage DNS over HTTPS and can be currently observed in the wild. Additionally, we describe three realworld abuse scenarios observed in the web environment that reveal how service providers intentionally use DNS over HTTPS to violate policies. Last but not least, we identified several research challenges that we consider important for future security research.

show abstract

“…The validNonLeaf rule has two critical branches for validating the non-leaf as an intermediate (32)(33)(34)(35)(36)(37)(38)(39) and for validating it as a root (41)(42)(43)(44). 7 The validNonLeaf rule is called recursively until a root is reached.…”

Section: Example Policy: Mozilla Firefoxmentioning

confidence: 99%

Hammurabi

Larisch

Aqeel

Lum

et al. 2022

Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

This paper proposes using a logic programming language to disentangle X.509 certificate validation policy from mechanism. Expressing validation policies in a logic programming language provides multiple benefits. First, policy and mechanism can be more independently written, augmented, and analyzed compared to the current practice of interweaving them within a C or C++ implementation. Once written, these policies can be easily shared and modified for use in different TLS clients. Further, logic programming allows us to determine when clients differ in their policies and use the power of imputation to automatically generate interesting certificates, e.g., a certificate that will be accepted by one browser but not by another.We present a new framework called Hammurabi for expressing validation policies, and we demonstrate that we can express the complex policies of the Google Chrome and Mozilla Firefox web browsers in this framework. We confirm the fidelity of the Hammurabi policies by comparing the validation decisions they make with those made by the browsers themselves on over ten million certificate chains derived from Certificate Transparency logs, as well as 100K synthetic chains. We also use imputation to discover nine validation differences between the two browsers' policies. Finally, we demonstrate the feasibility of integrating Hammurabi into Firefox and the Go language in less than 100 lines of code each. CCS CONCEPTS• Security and privacy → Web protocol security; Logic and verification.

show abstract

Measuring DNS-over-HTTPS performance around the world

Cited by 20 publications

References 17 publications

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques

Summary of DNS Over HTTPS Abuse

Hammurabi

Contact Info

Product

Resources

About