4 ms·
A way to protect yourself is to manually specify DNS servers - to your own, or a trusted public one like 4.4.2.2 or 8.8.8.8. It's buried in the network settings
by stephengillie 9y ago
A way to protect yourself is to manually specify DNS servers - to your own, or a trusted public one like 4.4.2.2 or 8.8.8.8. It's buried in the network settings, but DNS servers can be specified even if you're getting your IP from DHCP.
This attack only works if you're getting DNS info from a malicious/compromised source. So if you're on a coffee shop WiFi, it creates another layer of complexity - the attacker would have to rewrite/spoof the DNS packets instead of simply serving the malformed packets directly.
- jonknee 9y agoWould that make a difference if you're getting MITM?
- stephengillie 9y agoThe coffee shop WiFi would have to rewrite the packets with a new payload. Not too difficult, but a different skillset and scope than the original attack.
- SadWebDeveloper 9y agoNo, unless you configure your IP address statically and use a VPN that doesn't require a DNS lookup to connect so basically, it's hard to avoid these issues on a rouge network.
- Santosh83 9y agoIsn't that 4.4.4.4 or does Google also have a public DNS server on 4.4.2.2?
- stephengillie 9y ago4.4.2.2 is Level3, now owned by CenturyLink.
- deleted 9y ago[deleted]
- jwilk 9y agoGoogle Public DNS IPs are 8.8.8.8 and 8.8.4.4. Source: https://developers.google.com/speed/public-dns/ https://developers.google.com/speed/public-dns/
- mobilio 9y agoAnd why you think that someone can make free WiFi hotspot and can't route that both IPs to it's own DNS server?
- stephengillie 9y agoBy default, probably 99.99% of devices will use the WiFi DNS. The attackers may not want to go through the difficulty of changing routes to handle that .01% exception. That 99.99% might be good enough for them.
- edwhitesell 9y agoA lot of WiFi hotspot gear has built-in functionality to intercept/redirect DNS traffic. Or, as they are routers already, the ability to do it with firewall rules and such. We've talked about the risks of these kinds of MitM attacks for years. The good news is, the large players have vested interest to keep their networks secure.
- rasz 9y ago>A lot of WiFi hotspot gear sure, and they all run vulnerable Dnsmasq, win win.