4 ms·

Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some a

by dastx 6y ago

Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`. When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more. What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. This CNAME method is also a huge security issue, but I'm not gonna go into that.

pottertheotter 6y ago
> This CNAME method is also a huge security issue, but I'm not gonna go into that. A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?
- yjftsjthsd-h 6y ago
  For the website - https://news.ycombinator.com/item?id=23137309 https://news.ycombinator.com/item?id=23137309
xwdv 6y ago
> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.
- sciurus 6y ago
  This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.
- totetsu 6y ago
  How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)
  - edoceo 6y ago
    Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)
- lonelappde 6y ago
  That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?
  - breakingcups 6y ago
    Yep, that combined with an orphaned DNS record
ciarannolan 6y ago
>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?
- riquito 6y ago
  > So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right? Right
- yjftsjthsd-h 6y ago
  > So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right? Yeah, uBlock Origin recently added a new permission request just to allow that.
  - MattSteelblade 6y ago
    From my understanding, it only works in Firefox and not Chrome though as an FYI.
    - dastx 6y ago
      Correct. Chrome doesn't have such mechanism and if I'm not mistaken, they've already shot down the idea of adding this API.
m463 6y ago
cdn.goodsite.com -> tracker.badsite.com cdn used to mean - serve the same static content all over the world and speed things up. cdn now means - serve up different content to every single person and track them. take a look at stack overflow and it's cdn.
- cortesoft 6y ago
  Just because bad guys use a CDN doesn't mean CDNs are bad
GekkePrutser 6y ago
Thanks! I hadn't heard of this method. One question though: What will prevent the ad providers from asking their customers to add an A/AAAA record to one of their IPs? That'll be much harder to combat for an adblocker especially because those IPs will usually be shared with actual content services. Of course this'll add overhead to the visited website manager because the IPs will probably change regularly as they're pointing to cloud services. But I'm sure they'll manage to automate this. I bet this will be the next step in this cat & mouse game.
- RussianCow 6y ago
  I think it would be only marginally harder to combat, since now you just need a list of IPs to block. Someone would have to maintain the (likely ever changing) list of IPs used, but that's not so different from what's happening now.
  - ignoramous 6y ago
    > Someone would have to maintain the (likely ever changing) list of IPs used What if the ad-network is domain-fronting via a CDN? Either ways, can't block IPs since http-domain <-> IP isn't supposed to be a one-to-one mapping, each belong to different layers of the TCP/IP stak.
- deleted 6y ago
  [deleted]

by dastx 6y ago

pottertheotter 6y ago

> This CNAME method is also a huge security issue, but I'm not gonna go into that. A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?

yjftsjthsd-h 6y ago
For the website - https://news.ycombinator.com/item?id=23137309 https://news.ycombinator.com/item?id=23137309

xwdv 6y ago

> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

sciurus 6y ago
This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.
totetsu 6y ago
How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)
- edoceo 6y ago
  Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)
lonelappde 6y ago
That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?
- breakingcups 6y ago
  Yep, that combined with an orphaned DNS record

ciarannolan 6y ago

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

riquito 6y ago
> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right? Right
yjftsjthsd-h 6y ago
> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right? Yeah, uBlock Origin recently added a new permission request just to allow that.
- MattSteelblade 6y ago
  From my understanding, it only works in Firefox and not Chrome though as an FYI.
  - dastx 6y ago
    Correct. Chrome doesn't have such mechanism and if I'm not mistaken, they've already shot down the idea of adding this API.

m463 6y ago

cdn.goodsite.com -> tracker.badsite.com cdn used to mean - serve the same static content all over the world and speed things up. cdn now means - serve up different content to every single person and track them. take a look at stack overflow and it's cdn.

cortesoft 6y ago
Just because bad guys use a CDN doesn't mean CDNs are bad

GekkePrutser 6y ago

Thanks! I hadn't heard of this method. One question though: What will prevent the ad providers from asking their customers to add an A/AAAA record to one of their IPs? That'll be much harder to combat for an adblocker especially because those IPs will usually be shared with actual content services. Of course this'll add overhead to the visited website manager because the IPs will probably change regularly as they're pointing to cloud services. But I'm sure they'll manage to automate this. I bet this will be the next step in this cat & mouse game.

RussianCow 6y ago
I think it would be only marginally harder to combat, since now you just need a list of IPs to block. Someone would have to maintain the (likely ever changing) list of IPs used, but that's not so different from what's happening now.
- ignoramous 6y ago
  > Someone would have to maintain the (likely ever changing) list of IPs used What if the ad-network is domain-fronting via a CDN? Either ways, can't block IPs since http-domain <-> IP isn't supposed to be a one-to-one mapping, each belong to different layers of the TCP/IP stak.
deleted 6y ago
[deleted]