3 ms·

I don’t understand why it has to randomly generate new domains each time. Surely all that matters is that it’s testing for domains that are statistically unlike

I don’t understand why it has to randomly generate new domains each time. Surely all that matters is that it’s testing for domains that are statistically unlikely to exist, right? Why not seed the RNG with something like the current date, such that the domains are still random, but all instances of Chrome generate the same domains every day? That way the NXDOMAIN results should be able to be cached by upstream resolvers, thus significantly reducing the load on the root servers.

JoshTriplett 6y ago
If they were in any way predictable, people would register them, or the broken DNS servers would handle those domains properly while still giving broken results for others.
- 1f60c 6y ago
  That shouldn't be a problem: I don't think it's possible to make qwajuixk resolve to anything on the public internet. I bet they could hardcode a list of domains, change it up every couple releases, and that'd stop 80% of the rogue sysadmins who are doing this.
  - recursive 6y ago
    I don't think so. If there is any kind of predictability, I think at least 80% of the spam would come back. And these aren't rogue sysadmins. Huge companies are doing this.
  - theonemind 6y ago
    I've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell them to do it. The first big ISP would get it working pretty quickly no matter what Google did, then other big companies would see it and tell their sysadmins to figure it out, the other company is already doing it. I bet there's a decent amount of cash in DNS hijacking for big players, so you should probably think of it like the hypothetical cryptography attacker. You should assume they will know everything about your method but still can't beat it. If you can tell them what you're doing and they can beat it, they will. They wouldn't have done it in the first place without motivation.
    - SAI_Peregrinus 6y ago
      Send one request to such a random domain over DoH or DoT to some DNS server you control for the purpose (Google can easily set such a thing up). Ensure the response is NXDOMAIN. If it's not, generate a new random domain and retry. Send a second request of the same domain via the system DNS. If it's not NXDOMAIN, it's hijacking unknown DNS requests. One request that might hit the root instead of 3.
  - dylz 6y ago
    It is possible when you are the ISP and you control resolvers. You can very easily just make 'qwajuixk.' or 'qwajuixk' + dhcp assigned search domain return one of your spam IPs.
singingboyo 6y ago
In that case, the ISP runs chromium, figures out the domains, and they can stop hijacking those domains. Then the feature gets the wrong result for the rest of the day. (Hell, it's open source, ISP could just integrate the algorithm into their DNS hijacking logic).
- lilyball 6y ago
  There’s not really any benefit to the ISP to doing this. If there was, ISPs would already detect 3 quick requests from a client that fits this pattern and disable the domain hijacking for the second and third request (or even for all 3 if they’re confident enough that the first request is part of this pattern).

JoshTriplett 6y ago

If they were in any way predictable, people would register them, or the broken DNS servers would handle those domains properly while still giving broken results for others.

1f60c 6y ago
That shouldn't be a problem: I don't think it's possible to make qwajuixk resolve to anything on the public internet. I bet they could hardcode a list of domains, change it up every couple releases, and that'd stop 80% of the rogue sysadmins who are doing this.
- recursive 6y ago
  I don't think so. If there is any kind of predictability, I think at least 80% of the spam would come back. And these aren't rogue sysadmins. Huge companies are doing this.
- theonemind 6y ago
  I've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell them to do it. The first big ISP would get it working pretty quickly no matter what Google did, then other big companies would see it and tell their sysadmins to figure it out, the other company is already doing it. I bet there's a decent amount of cash in DNS hijacking for big players, so you should probably think of it like the hypothetical cryptography attacker. You should assume they will know everything about your method but still can't beat it. If you can tell them what you're doing and they can beat it, they will. They wouldn't have done it in the first place without motivation.
  - SAI_Peregrinus 6y ago
    Send one request to such a random domain over DoH or DoT to some DNS server you control for the purpose (Google can easily set such a thing up). Ensure the response is NXDOMAIN. If it's not, generate a new random domain and retry. Send a second request of the same domain via the system DNS. If it's not NXDOMAIN, it's hijacking unknown DNS requests. One request that might hit the root instead of 3.
- dylz 6y ago
  It is possible when you are the ISP and you control resolvers. You can very easily just make 'qwajuixk.' or 'qwajuixk' + dhcp assigned search domain return one of your spam IPs.

singingboyo 6y ago

In that case, the ISP runs chromium, figures out the domains, and they can stop hijacking those domains. Then the feature gets the wrong result for the rest of the day. (Hell, it's open source, ISP could just integrate the algorithm into their DNS hijacking logic).

lilyball 6y ago
There’s not really any benefit to the ISP to doing this. If there was, ISPs would already detect 3 quick requests from a client that fits this pattern and disable the domain hijacking for the second and third request (or even for all 3 if they’re confident enough that the first request is part of this pattern).