The DNS Prank

Misdirection vs. Acceptable Use Policy

• HR Actions Initiated on the Basis of Log Entries

• String Matching, Content Blocking

• Inverse "Semantic Attack:" Telling the Truth, but Fostering Misinterpretation

How do we do it?

• Set up a web server

• Make an /images directory

• Fill it with innocuous images that have naughty names

• Register a domain (naughty or nice)

• Point the www record at the web server

• Compose some HTML e-mail

• Netcat it to a mail server