"DNS routing history" what are you even talking about? What is "DNS routing"? DNS is name/address mapping and contains no routing information. And it's cached so it's always going to be incomplete. And how does it give away your firmware version?
Actually, yeah, that's true. At first I thought it was giving full URLs, which is very useful to attackers, even with caching. Turns out, it's just domains. Full URLs can give a lot of information, though. For firmware, for example... aside from the address of where they downloaded the firmware, you also get all the troubleshooting pages they went to, and even the places they asked for help last time they were troubleshooting something, and the answers they got. If I wanted to go after somebody, their google search history alone can be a million times more useful than their IP address and a port scan.
Even with caching, a list of simple domains still provides very actionable information, though! To illustrate:
Lets say you have a rival at the local HOA. You are having a bitter fight over pink flamingos or something. So you want to do bad things to him, and he owns a company, so you're gonna target that company with your evil hacking skills. For whatever reason, your starting point is this list of URLs from their DNS server. Why? How did you get this list? IDK, maybe a Russian gave it to you or something. For whatever stupid reason, I'll just assume you got this list legitimately (because I think people in this thread's heads would explode if we tried going down that rabbit hole). So the domain access history off the DNS server is your starting point...
In the HOA rival's company, lets say there are 30 persons of interest. If you can force them to quit, or blackmail them, or generally fuck up their lives, you can make chaos in the HOA rival's company. Where do you focus your attack? To make this physical, lets say you have 6 private investigators who can tail up to 3 people at a time. So you have to pick 3 people to tell the private investigators to focus on. Who do you focus on?
You probably want the guy who spent lots of time in google spreadsheets, planning things. Even if you get nothing on him, you can learn about the company from him, and if he's the one workaholic that's actually doing all the work in his department, you can fuck up that department by fucking with him. Then you are going to go after the pervert, who spent all day browsing PornHub and Tinder. Then maybe you follow the guy who is hitting the day trading sites all day long. He's got to be insider trading or something. Day traders always have something to hide. If not, go after the guy hitting the casino apps, or the crypto currency apps all day. He's got money problems. There's a million different horrible things you can do to somebody with money problems. I think the chances you get some combination of these 3 types of people in any random group of 30 are pretty good.
At least, that's how I would use it. I'm sure there are others with more active imaginations than me who would handle it differently.
