7 ms·
Thai Database Leaks 8.3B Internet Records
- cbg0 6y ago> To be clear: DoH and/or DoT would have stopped the gathering of DNS query data in this case. It's simple to set up, and it's just a smart thing to do for anyone concerned about their privacy. Actually, for most people that are not technically savvy this is definitely not an easy thing to set up, nor are they even aware that DoH/DoT exist. Unless this feature starts being turned on by default in routers and popular software, the average user's DNS lookups will not be protected.
- sirn 6y ago> Unless this feature starts being turned on by default in routers and popular software Firefox has DoH turned on by default for US-based users. Unfortunately being US-only, it won't protect Thai users just yet. Especially considering the fact that Thai ISPs have known to be hijacking port 53 and NXDOMAIN since forever[1] with ISP in the article being one of the biggest offender. It might also worth nothing that PDPA, Thailand's equivalent of GDPR, is to become in effective in two days (May 27th) so this incident will be... interesting. [1]: Starting in early 2000s, with NIPA (that I never see anybody uses), who aim to provide IDN-enabled Thai domain names by providing NXDOMAIN-hijacking services to ISP
- blitmap 6y agoI recently set up a dns-over-https (doh) proxy on my router to forward dns requests to 5 resolvers, that also use dnssec. I wish Firefox would expose the option from about:config in its user-friendly Preferences page so it will respect the "system default" (the advertised dns server). I am - for no legitimate reasons - avoiding Cloudflare as a resolver. As far as I know Firefox uses Cloudflare.
- encom 6y agoHave you been able to find a trustworthy public DoT resolver? I really want to use uncensoreddns.org, but availability has been a little flaky in the past. I'm not sure about Quad9. Google and CloudFlare are obviously out of the question. What else is there?
- cbg0 6y ago> Have you been able to find a trustworthy public DoT resolver? It really depends what you view as being "trustworthy". Outside of the US good enough? Or do you want non 5/9/14-Eyes? (https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eyes,_and_other_%22third_parties%22 https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes,_14_Eye...)
- encom 6y agoLet's start with "not Google-levels of creepy" and work up from there. I want someone who's not harvesting data, or engaging in censorship.
- fidelramos 6y agoCheck out this list in privacytools.io: https://www.privacytools.io/providers/dns/ https://www.privacytools.io/providers/dns/
- nix23 6y agoYes, well i trust this one: DoT: dns.digitale-gesellschaft.ch DoH: dns.digitale-gesellschaft.ch/dns-query Source: https://de.wikipedia.org/wiki/DNS_over_HTTPS https://de.wikipedia.org/wiki/DNS_over_HTTPS https://de.wikipedia.org/wiki/DNS_over_TLS https://de.wikipedia.org/wiki/DNS_over_TLS https://www.digitale-gesellschaft.ch/dns/ https://www.digitale-gesellschaft.ch/dns/ Sorry, for not being available in the en-wiki
- encom 6y agoHadn't seem them before, very interesting. Vielen dank.
- shp0ngle 6y agoDoH just moves the logging from Thai telecom and moves it to Cloudflare (or, whoever you set up as your DoH server, but most likely Cloudflare), no? I trust CF much more than my ISP, but it makes the potential leak much worse... edit: On the other hand, DoH makes DNS requests independent of ISP, which is nice. ISPs are often monopoly by nature.
- cbg0 6y agoCloudflare has a privacy policy https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ https://developers.cloudflare.com/1.1.1.1/privacy/public-dns... Obviously, for Thai users this is a reasonable option, but I would understand why American users would not want to use Cloudflare, Google or even Quad9, as these are all US-based.
- arminiusreturns 6y agoI thought quad9 was UK based?
- cbg0 6y agoBottom of quad9.net says: HQ 1442 A Walnut Street Suite 501 Berkeley CA 94709
- arminiusreturns 6y agoAha, figured out I was confused because I read about their membership in the Global Cyber Alliance which includes members such as the London Police and the NYPD. Bonus if you are interested: forum thread where Quad9's director of the board comments about DNS are surprisingly informational. https://www.snbforums.com/threads/cloud9-dns.56918/ https://www.snbforums.com/threads/cloud9-dns.56918/
- belorn 6y agoThe netflow data from cloudflare, which is 0.05% of all traffic, is retained for 60 days according do the compliance report. 8.3B log entries is a lot, but I suspect that given how large market share cloudflare has, 0.05% over 60 days is also not a small data set. My intuition with probability calculus make me suspect that given normal internet usage over 60 days, a person is more likely than not to end up in cloudflares netflow log.
- nix23 6y agoWell in Firefox you can turn it on: about:preferences#general >> Network Settings >> Settings...
- koheripbal 6y agoWhere is the setting in Chrome? It's not on by default in the latest version, and not available in the flags/settings...
- swiley 6y agoMost malicious ISPs disable DoH (ex: Verizon) so it likely wouldn’t have solved this. If you want it solved find a protocol that can be used in the libc resolver and make it ubiquitous rather than goofing around with browser defaults.
- microcolonel 6y agoHow do they disable DoH? They block TLS over that port?
- nix23 6y agoThats DoT, DoH ist just a dns query over https(443)
- microcolonel 6y agoAlright, I repeat my question, since it's almost identical: how do they block that? HTTPS starts with opening a TLS socket, how do they reliably determine that they can drop that traffic?
- cbg0 6y agoI don't know if Verizon is actively doing it, but since most providers that offer DoH have well-known IPs, like 8.8.8.8, 1.1.1.1, 9.9.9.9, they could easily just block traffic heading in that direction.
- deleted 6y ago[deleted]
- o-__-o 6y agoThis follows along with what I read, at first it’s easy to block but it’s a losing proposition because anyone can stand up a doh server (which is also a network security nightmare)
- baicunko 6y agoThis is something that the average user fails to understand. One thing is saying I don't care they check on what I visit but once you aggregate enough information, it can become something of a "Big Brother". With enough DNS data I can assure you I can see when you leave to work, get back, determine the moment when you leave for vacation and no one is home, etc.
- cbg0 6y agoYou wouldn't even need DNS data, just how much Internet traffic a specific connection or device is using is enough to determine these things.
- sirn 6y ago(Disclosure: I'm Thai) Especially in Thailand, where free speech is almost non-existent. Few months ago there were Twitter user who goes by the name "Anonymous" ("นิรนาม" in Thai) who have been arrested for spreading fake news and being a threat to the country. The Twitter user mainly tweets about topics subjected to lèse-majesté law. He never leave any traces, which leaves question on how officials managed to track him down if Twitter claims they didn't received any requests from our government. My small group of friend came up with one scenario where official sent a honeypot URL via Twitter DM, then trace him via DNS query logs. This is assuming the scenario where he don't click on random links and using a browser that performs DNS prefetching of sorts. Everyone thought it was unlikely at the time, partly because nobody thought ISP would actually logging all DNS queries. Apparently, all of us were wrong, at least on the latter.
- postcynical 6y agoBut aren't all the URLs in the messages/notifications "shortened" to a t.co/. So he would have had to click on the link.
- sirn 6y agoThis was also why everyone believed it's unlikely. Also I don't think Twitter even has DNS prefetching turned on. However now it's revealed that logging is real, us Thais should be worried.
- deleted 6y ago[deleted]
- lisk1 6y agoSolution for this is to tunnel the traffic through encrypted connection to servers in countries that respect persons privacy(if that is true nowadays). The easiest way is to use WireGuard, easy to set up uses only one port and have clients for many devices.
- nurettin 6y agoIf you trust your vps dns, easiest way would be autossh -D<port> <user@host> and set your browser's socks5 proxy to localhost:<port> and tell it to use remote dns when resolving domains. This requires no wireguard setup, no certificate generation or anything.
- bouncycastle 6y agoI've been doing both and have to say Wireguard is much more performant and stable than an ssh tunnel. Besides, it shouldn't be too hard to set it up on a VPS.
- GordonS 6y agoAs a counter point about reliability, I've been tunnelling my HTTP traffic (and DNS) through SSH (to get around corporate restrictions and monitoring) for 10 years or so - I don't think I've ever had any reliability issues.
- bouncycastle 6y agoI've had a lot of problems: latency, ssh tcp connections dropping packets and whole connection becoming unstable, manually configure proxy / browser each time & also sometimes you may forget to start the tunnel. You also need to start a new ssh connection for each port you want to forward, so you end up managing a bunch of ssh connections if you want to expose some services for example. Wireguard is more deeper down the layers and just works without jumping through hoops - none of the apps are aware of it and when it's on, it just stays on). Of course, when all you have is ssh to get around pesky restrictions, then I guess that will do fine too! ;-)
- cm2187 6y agoThere is a special place in hell for software developers who write server software with no authentication by default.
- deleted 6y ago[deleted]
- a012 6y agoSome of them might respond with something similar to "if you know what you are doing". Probably, security is someone else's job.
- cm2187 6y agoEvery single one of their customer is a customer that one day installed it for the first time and didn't know what they were doing because they didn't know the product. And with the complexity of modern software, imagine if the defaults in the whole software stack all the way down to the OS and hardware were open by default. You would need to be an expert in security to set up anything. Thanks god everyone else goes secure by default.
- jgaa 6y agoI think you will find that place quite empty, today and in the future. The other place, where "product owners" and pointy haired managers mingle - that place will be quite crowded when their TTL expires.
- Dolores12 6y agoAIS is mobile operator hence assign you random IP from the pool every time you reconnect to the network. IP address could be used by many different users during a day, definitely not a household as author states. Looks like useless data for me.
- Narkov 6y agoSessions on mobile networks can last for many days and even weeks. The data is far from useless and could be used to enhance or append to other data sources.
- sirn 6y agoThey also have residential internet (AIS Fibre) and also own another ISP (CS Loxinfo). CS Loxinfo used to use their own DNS servers and such, but have switched to use the same infrastructure as AIS Fibre (sharing IP address pool and all) since 2019 or so. Also AIS mobile is IPv6 (2001:44c8:4400::/44) with CG-NAT since 2017. IIRC they were giving out /64 to every mobile client, but I'm not sure how long does /64 assignment lasts.
- lisk1 6y agoalso they probably, like every ISP nowadays know when what IP to who was assigned so dynamic IP is not guarantee for anonymity
- dirtylowprofile 6y agoCan someone enlighten me who and what is rainbowtabl.es?
- kernyan 6y ago> Interestingly enough AWN had this DNS dashboard saved with a filter specifically looking at Facebook traffic. It's unclear why they would be particularly interested in who was going to Facebook. One likely non-malicious explanation is that the telco is offering some plan with data caps based on social media such as instagram, facebook, etc. Searching around, I found the offering below for unlimited data on 9 social media apps http://www.ais.co.th/one-2-call/simcard/en/super_social.html?intcid=one2call-simcard-en-bt_detail-super_social http://www.ais.co.th/one-2-call/simcard/en/super_social.html... I'm guessing one way the telco implements the selective cap is by tracking user's DNS, and is probably interested to know traffic to facebook
- deleted 6y ago[deleted]