OpenDNS malware protection

[Cale Stultz]

Received and email from OpenDNS today announcing that they were offering protection from malware at the IP address level.  They say they can stop malware from getting to my workstations. 

Has anyone used them for this and if so what has been your experience?  The price seems right and since in the past three months I've had to spend hours creating new profiles for a couple of users who got hit, we are thinking of using them.

[Bloody Jack Kidd]

stopping by hostname is their strong suit - blocking by ip I would imagine is going to require some type of agent or proxy.

I'm not sure of their pricing structure, but you can do quiet well with your own DNS blackhole.

[Jason@KiteTech]

stopping by hostname is their strong suit - blocking by ip I would imagine is going to require some type of agent or proxy.

They could simply poison the routes of known bad IP's, so they don't hop anywhere.

[Mark]

stopping by hostname is their strong suit - blocking by ip I would imagine is going to require some type of agent or proxy.

I'm not sure of their pricing structure, but you can do quiet well with your own DNS blackhole.

I have seen OpenDNS block by IP.

[Bloody Jack Kidd]

I've have to run wireshark to verify, but it's possible that a browser trying to go to http://123.123.123.123 generates a PTR lookup - then OpenDNS can do something.  But a piece of malware trying to connect to a CNC at 123.123.123.123 may not generate DNS activity, which negates a DNS safety feature.

[Mark]

I've have to run wireshark to verify, but it's possible that a browser trying to go to http://123.123.123.123 generates a PTR lookup - then OpenDNS can do something.  But a piece of malware trying to connect to a CNC at 123.123.123.123 may not generate DNS activity, which negates a DNS safety feature.

Trust me, I was furiously confused when it happened to me.  I was specifically trying to walk past the Free OpenDNS filtering that *I* setup! lol  I was also getting annoyed that they kept sending me stuff about how great their paid service is and I thought it was laughable because it was *so easy to bypass*.

I didn't spend too much time on it, but I wasn't able to view what I wanted by IP.