QUIC and DNS over HTTPS

When not understanding the big picture hurts cybersecurity

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

🔒 Related Stories: Network Security | DNS Security | Google Security.

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Update 6/15/23 Google is trying to rearrange packets are sent such that it breaks networks using standard firewall rules. Read my other posts on network security and try to create the rules I’ve setup to see what I mean.

Right now I’m looking at logs and Google is sending UDP packets on port 443 for YouTube TV. That means I have to open up a new protocol on port 443 which increases risk. Attackers that can get onto your system can try to blend in by sending outbound traffic on port 443 UDP. One more avenue for their traffic to escape your network unnoticed. I lock that down to Google IPs only but the problem is…Google Cloud. I’m seeing a lot of scanning from Google Cloud. How do I know if the traffic is for YouTube TV or an attacker in Google Cloud?

Right now I am constantly getting lots of packets blocked when using streaming protocols that are likely using newer “fast” methods that try to make inbound connections and skip traditional means of establishing connections. Um, those methods of establishing connections are there for a reason. I am still trying to…