4 ms·

That shouldn't be a problem: I don't think it's possible to make qwajuixk resolve to anything on the public internet. I bet they could hardcode a list of domain

by 1f60c 6y ago

That shouldn't be a problem: I don't think it's possible to make qwajuixk resolve to anything on the public internet. I bet they could hardcode a list of domains, change it up every couple releases, and that'd stop 80% of the rogue sysadmins who are doing this.

recursive 6y ago
I don't think so. If there is any kind of predictability, I think at least 80% of the spam would come back. And these aren't rogue sysadmins. Huge companies are doing this.
theonemind 6y ago
I've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell them to do it. The first big ISP would get it working pretty quickly no matter what Google did, then other big companies would see it and tell their sysadmins to figure it out, the other company is already doing it. I bet there's a decent amount of cash in DNS hijacking for big players, so you should probably think of it like the hypothetical cryptography attacker. You should assume they will know everything about your method but still can't beat it. If you can tell them what you're doing and they can beat it, they will. They wouldn't have done it in the first place without motivation.
- SAI_Peregrinus 6y ago
  Send one request to such a random domain over DoH or DoT to some DNS server you control for the purpose (Google can easily set such a thing up). Ensure the response is NXDOMAIN. If it's not, generate a new random domain and retry. Send a second request of the same domain via the system DNS. If it's not NXDOMAIN, it's hijacking unknown DNS requests. One request that might hit the root instead of 3.
dylz 6y ago
It is possible when you are the ISP and you control resolvers. You can very easily just make 'qwajuixk.' or 'qwajuixk' + dhcp assigned search domain return one of your spam IPs.

by 1f60c 6y ago

recursive 6y ago

I don't think so. If there is any kind of predictability, I think at least 80% of the spam would come back. And these aren't rogue sysadmins. Huge companies are doing this.

theonemind 6y ago

I've mostly seen DNS hijacking from large ISPs. Probably hardly any sysadmin anywhere wants to implement DNS hijacking, but have corporate overlords that tell them to do it. The first big ISP would get it working pretty quickly no matter what Google did, then other big companies would see it and tell their sysadmins to figure it out, the other company is already doing it. I bet there's a decent amount of cash in DNS hijacking for big players, so you should probably think of it like the hypothetical cryptography attacker. You should assume they will know everything about your method but still can't beat it. If you can tell them what you're doing and they can beat it, they will. They wouldn't have done it in the first place without motivation.

SAI_Peregrinus 6y ago
Send one request to such a random domain over DoH or DoT to some DNS server you control for the purpose (Google can easily set such a thing up). Ensure the response is NXDOMAIN. If it's not, generate a new random domain and retry. Send a second request of the same domain via the system DNS. If it's not NXDOMAIN, it's hijacking unknown DNS requests. One request that might hit the root instead of 3.

dylz 6y ago

It is possible when you are the ISP and you control resolvers. You can very easily just make 'qwajuixk.' or 'qwajuixk' + dhcp assigned search domain return one of your spam IPs.