3 ms·
No, they couldn't. The whole purpose of these probe requests is to assess whether the DNS server used by a particular client is acting normally (responding with
by Slartie 6y ago
No, they couldn't. The whole purpose of these probe requests is to assess whether the DNS server used by a particular client is acting normally (responding with NXDOMAIN if a domain does not exist), so these must bde sent to the DNS server of the client, which effectively means that unless this DNS server performs the hijacking that is to be detected, they will inevitably end up on a root DNS server, because no server in the hierarchy will know those domains.
Forcing these probe requests onto Google's DNS would completely defy their purpose in the first place.
- majewsky 6y agoInstead of http://asdoguhwrouyh http://asdoguhwrouyh, they could probe something like http://asdoguhwrouyh.google http://asdoguhwrouyh.google or anything else in a zone owned by them, so the uncachable traffic would hit only their authoritative name servers and not the root servers.
- warp 6y agoBut then a lying DNS server could easily identify those, and NOT lie about http://*.google http://*.google -- the reason these requests are entirely random domain names is so they're not easily recognized as probes.
- xnyanta 6y agoExcept that the queries are already totally identifiable as probes in their current form, which is demonstrated in the article.
- JdeBP 6y ago... only when the delegation for google. is cached.
- thayne 6y agoah, good point.