4 ms·
About 14 years ago, during my training at a large IT company, I had the pleasure and privilege to lay out a security policy for a migration from BIND4 to BIND9.
by krylon 8y ago
About 14 years ago, during my training at a large IT company, I had the pleasure and privilege to lay out a security policy for a migration from BIND4 to BIND9. I was more than flattered that they bestowed such an important task to a lowly trainee, so I really dug in there, and for about three months I immersed myself in the finer details of DNS and security and why the two rarely talk with each other.
I clearly remember thinking how lucky we were that nobody had so far come along and just picked at the ripe, juicy, low-hanging fruit of problems inherent to the DNS protocol itself. Nevermind the implementation bugs that might want to join the party.
Fast-forward to the present, where still no major breach of the DNS system has garnered enough public attention to warrant a cutesy name. Not DNSBleed, MeltDNS, DNSrown, or PooDNSle.
Did we just get lucky? Given how low-hanging and overly-ripe this particular fruit was (is?), I find that hard to believe. Either the Domain Name System is far more resilient to attacks than it appears at first glance, or attackers have been feeding us the blue pill all along and attacks like DNS Cache-poisoning are commonplace and some magically manage to stay under the radar. Or do they just not bother?
It is slightly consfusing, because DNS (sans DNSSEC, which many clients remain blissfully unaware of) seems to me to be the Striped Biologist-Taunter of network protocols: it is practically begging to be hijacked and exploited the crap out of.
Do criminals just not care, or do they have too much respect for such a low layer of infrastructure?
- lgierth 8y agoDNS hijacking happens all the time, every day - we just don't seem to unconditionally recognize it as attacks. Paywalls on airport/cafe wifis, nation-state censorship of individual websites, etc. :) I work on IPFS/libp2p and the "only" two known attacks on the official gateway ipfs.io are in Spain (DNS hijacking) and China (dito). OONI has pretty good data on interference around the world: https://ooni.torproject.org/ https://ooni.torproject.org/ (edit: clarified that the attack is only on the ipfs.io gateway, not the IPFS network)
- pathseeker 8y agoPaywalls rarely use DNS hijacking because it risks putting a bad entry in the clients cache and breaking them. They just intercept http (and sometimes HTTPS) connections to inject a temporary HTTP redirect to an auth page.
- lgierth 8y agoEh you're right, thank you - I meant routers that hijack DNS to send you to a captive portal or splash page.
- WorldMaker 8y agoI changed the root DNS servers in my home router when I found my (American) ISP was DNS poisoning bing.com (and who knows what else!) for extra ad revenue.
- lgierth 8y agoYour comment just made me remember that T-Online and a few other german ISPs hijack NXDOMAIN responses and send you to their crappy search pages.
- blattimwind 8y agoYou can disable that in your customer settings, though. It's still crap, of course.
- krylon 8y agoOh yes, I was so pissed off when I saw that for the first time. At home I run my own resolver, so this does not affect me, but I still cannot understand how somebody could think this was a good idea...