3 ms·

DNS has always been one of the weakest links in security in my personal experience. From transparent DNS proxing, to DNS hijacking in local network attacks, to

by _pdp_ 10y ago

DNS has always been one of the weakest links in security in my personal experience. From transparent DNS proxing, to DNS hijacking in local network attacks, to complete and quite transparent, often very permanent and undetectable hijacks of consumer-level network equipment, such as routers, through trivial UPNP hacks.

minxomat 10y ago
The worst side effect of how my ISP implements this is the failure mode for DNS queries. Instead of returning an error code, they actually return a marketing page. That page contains a fake search engine, with results. If you look at the "results", they are all ads for the ISP I'm already on...
- gumby 10y ago
  In a just America, people who do this would be jailed. To add insult, the majority of my DNS lookups are not for hosts I'll contact via port 80 or 443, so even in some twisted universe where I wanted their ads, their lying doesn't help me.
- ChoGGi 10y ago
  You could switch to using GoogleDNS or OpenDNS. If you prefer something more privacy oriented, but possibly not as fast: https://servers.opennicproject.org/ 84.200.69.80 # dns.watch 84.200.70.40 # dns.watch 37.235.1.174 # freedns.zone 37.235.1.177 # freedns.zone 213.73.91.35 # dnscache.berlin.ccc.de 194.150.168.168 # dns.as250.net; Berlin/Frankfurt 85.214.20.141 # FoeBud (digitalcourage.de) 77.109.148.136 # privacyfoundation.ch 77.109.148.137 # privacyfoundation.ch 91.239.100.100 # anycast.censurfridns.dk 89.233.43.71 # ns1.censurfridns.dk 204.152.184.76 # f.6to4-servers.net, ISC, USA Edit: I know this won't do anything for ISPs using transparent proxies (from the article: "Some ISP's"). This is just for people with shitty, but not as shitty ISPs. Such as ones that hijack NXDOMAIN: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_ISPs https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_... Edit2: I couldn't get the test from dnsleaktest.com to work on my computer, but starting at step 3 from [0] seems to work fine (I do already use DNSCrypt with Unbound). [0] https://www.smartydns.com/support/isp-doing-transparent-dns-proxy/ https://www.smartydns.com/support/isp-doing-transparent-dns-...
  - eli 10y ago
    You should read the article
  - minxomat 10y ago
    You can't switch your DNS with transparent proxies. That's the whole point of this post. Even if you change your DNS server, your queries to that server are intercepted by your ISP.
    - eriknstr 10y ago
      You can pay for a VPN service that does not transparently proxy DNS and tunnel either DNS requests or DNS requests + other data through it to the DNS servers you are actually intending to use.
  - detaro 10y ago
    ... which doesn't do anything if DNS is transparently intercepted, as discussed in the article.
- rosstex 10y ago
  I used to wonder where those marketing pages came from, I had assumed it was a rogue browser extension. Now that I think about it... it must've been DNS!
- xorcist 10y ago
  apt-get install unbound && echo nameserver 127.0.0.1 > /etc/resolv.conf I'm sure you have 500 kB free RAM for a proper resolver that works in the real world, and validates DNSSEC for free. I think most resolving should be done locally nowadays. Latency is mostly a last mile problem.
  - voltagex_ 10y ago
    Wouldn't unbound's requests out to the net get caught by this proxying?
    - xorcist 10y ago
      I'd guess not since unbound does its own recursion. DNSSEC doesn't play well with nxdomain trickery so customers gets unhappy and that's something even shady ISPs avoid.
bluejekyll 10y ago
This is something I'm personally very interested in. I'm planning to add one or both of DNS over TLS (https://github.com/bluejekyll/trust-dns/issues/38 https://github.com/bluejekyll/trust-dns/issues/38) or DNSCrypt (https://github.com/bluejekyll/trust-dns/issues/4 https://github.com/bluejekyll/trust-dns/issues/4). Currently I'm planning to do just DNS over TLS. I'd love feedback on this if people are interested. Both of these address this issue pretty well.

by _pdp_ 10y ago

minxomat 10y ago

The worst side effect of how my ISP implements this is the failure mode for DNS queries. Instead of returning an error code, they actually return a marketing page. That page contains a fake search engine, with results. If you look at the "results", they are all ads for the ISP I'm already on...

gumby 10y ago
In a just America, people who do this would be jailed. To add insult, the majority of my DNS lookups are not for hosts I'll contact via port 80 or 443, so even in some twisted universe where I wanted their ads, their lying doesn't help me.
ChoGGi 10y ago
You could switch to using GoogleDNS or OpenDNS. If you prefer something more privacy oriented, but possibly not as fast: https://servers.opennicproject.org/ 84.200.69.80 # dns.watch 84.200.70.40 # dns.watch 37.235.1.174 # freedns.zone 37.235.1.177 # freedns.zone 213.73.91.35 # dnscache.berlin.ccc.de 194.150.168.168 # dns.as250.net; Berlin/Frankfurt 85.214.20.141 # FoeBud (digitalcourage.de) 77.109.148.136 # privacyfoundation.ch 77.109.148.137 # privacyfoundation.ch 91.239.100.100 # anycast.censurfridns.dk 89.233.43.71 # ns1.censurfridns.dk 204.152.184.76 # f.6to4-servers.net, ISC, USA Edit: I know this won't do anything for ISPs using transparent proxies (from the article: "Some ISP's"). This is just for people with shitty, but not as shitty ISPs. Such as ones that hijack NXDOMAIN: https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_ISPs https://en.wikipedia.org/wiki/DNS_hijacking#Manipulation_by_... Edit2: I couldn't get the test from dnsleaktest.com to work on my computer, but starting at step 3 from [0] seems to work fine (I do already use DNSCrypt with Unbound). [0] https://www.smartydns.com/support/isp-doing-transparent-dns-proxy/ https://www.smartydns.com/support/isp-doing-transparent-dns-...
- eli 10y ago
  You should read the article
- minxomat 10y ago
  You can't switch your DNS with transparent proxies. That's the whole point of this post. Even if you change your DNS server, your queries to that server are intercepted by your ISP.
  - eriknstr 10y ago
    You can pay for a VPN service that does not transparently proxy DNS and tunnel either DNS requests or DNS requests + other data through it to the DNS servers you are actually intending to use.
- detaro 10y ago
  ... which doesn't do anything if DNS is transparently intercepted, as discussed in the article.
rosstex 10y ago
I used to wonder where those marketing pages came from, I had assumed it was a rogue browser extension. Now that I think about it... it must've been DNS!
xorcist 10y ago
apt-get install unbound && echo nameserver 127.0.0.1 > /etc/resolv.conf I'm sure you have 500 kB free RAM for a proper resolver that works in the real world, and validates DNSSEC for free. I think most resolving should be done locally nowadays. Latency is mostly a last mile problem.
- voltagex_ 10y ago
  Wouldn't unbound's requests out to the net get caught by this proxying?
  - xorcist 10y ago
    I'd guess not since unbound does its own recursion. DNSSEC doesn't play well with nxdomain trickery so customers gets unhappy and that's something even shady ISPs avoid.

bluejekyll 10y ago

This is something I'm personally very interested in. I'm planning to add one or both of DNS over TLS (https://github.com/bluejekyll/trust-dns/issues/38 https://github.com/bluejekyll/trust-dns/issues/38) or DNSCrypt (https://github.com/bluejekyll/trust-dns/issues/4 https://github.com/bluejekyll/trust-dns/issues/4). Currently I'm planning to do just DNS over TLS. I'd love feedback on this if people are interested. Both of these address this issue pretty well.