7 ms·

Won't be long now until IoT and other crap-ware devices catch on to this trend and start hard-coding DNS servers in code, or worse, using DNS encryption to avoi

Won't be long now until IoT and other crap-ware devices catch on to this trend and start hard-coding DNS servers in code, or worse, using DNS encryption to avoid this sort of routine blocking by end-users. I wonder how people are thinking about solving this problem.

Group_B 4y ago
One of many reasons why I don’t even bother with IoT devices. Don’t need all this crap to be connected to wifi. There was nothing wrong with it before.
- Deritiod 4y ago
  It's not crap just because you don't see a benefit. In my opinion, additional being a curios software engineer I find it quite interesting. Necessary? Perhaps not but helpful. Heating valves for example.
  - aksss 4y ago
    Not that I’m terribly experienced with it, but a lot of home automation can be done without “IoT” — specifically without the crapware Trojan controllers that come with consumer solutions from Best Buy. ISY994 for example. Easy solutions for remote access via apps (vpn to home) and notifications as well. It’s not as easy to set up as a plug and play controller from Google, but it’s far more private.
    - Deritiod 4y ago
      I include your example. The definition of iot from Wikipedia also does it. But honestly why I hate my iot window blinds device it's the perfect excuse to use vlan at home.
lapser 4y ago
This is already happening. The likes of Google Home et al already hardcode their own servers. I noticed that no DNS requests were being made through my Pi Hole, so when I looked, it turned out their DNS servers were hardcoded. However, I'm more worried about when they start hardcoding DoH servers.
- doubled112 4y ago
  Same on DoH. I can’t filter it or redirect it like I can with plain old DNS.
  - lapser 4y ago
    Yes, really the only way would be to set up a MITM proxy on your network and enforce all traffic goes through that. Also means accepting a CA.
    - 1vuio0pswjnm7 4y ago
      Been using this solution myself for a number of years. Works remarkably well. I do not even use DNS recursion or any remote DNS requests because I can load bulk DNS data into the proxy's memory. There is only ever one nonrecursive request to a localhost authoritative DNS server and the answer is always the same: the address of the proxy. Ironically perhaps, DoH outside the browser can be used to gather the bulk DNS data, thanks to HTTP/1.1 pipelining. Many years ago I anticipated that "developers" would no longer allow end users to choose DNS servers. The developers' work, i.e., software, was dropping in market value and they began to adopt a Trojan Horse "business model". End users could use the software for free with the expectation that few would notice/complain about increased surveillance and data collection, or injected advertising. The so-called "MITM proxy" is neither a new nor radical idea. Corporations routinely "MITM" TLS traffic from their networks. Enterprise hardware/software companies have provided turnkey solutions. The issue is not limited to addresses for DNS servers. For example, WhatsApp hardcodes IP addresses in their mobile app. For that problem I use an application firewall. The PiHole is essentially a slightly modified version of dnsmasq running on a RPi. It is funny that no one has tried using other DNS software. Given a choice of DNS software, I would not choose dnsmasq. It also still seems that no one has presented a "PiHole" that uses a forward proxy instead of a DHCP/DNS server. Similar to corporations, home users need a turnkey solution for monitoring their home networks.
      - ClumsyPilot 4y ago
        " Similar to corporations, home users need a turnkey solution for monitoring their home networks." You'd think thats thr job of the router companies - they sell you hex-core routers for $390 or whatecer, but no usefull functionality
timbit42 4y ago
Have your gateway/firewall block all traffic from the LAN IP of the device from exiting the LAN. If it's running on Win/Mac/Linux/Android/iOS, block the app from talking to the gateway, or even the entire LAN.
- pdimitar 4y ago
  That's what I do with my printer. I love the company (Brother) and they make IMO the best printers and MFPs but I am quite paranoid already and I just block any WAN traffic. The printer is (and should be) really only used from the LAN anyway.
phillipseamore 4y ago
I already translate all port 53 traffic to my local resolver and block known DoH addresses.
- gruez 4y ago
  If they're really evil, they'd proxy all traffic through a single host (eg. d2v3i0u0qtn52v.cloudfront.net), so you have to choose between no IOT features, or getting subjected to all the ads/telemetry.
  - everdrive 4y ago
    >so you have to choose between no IOT features I'll bring out the fainting couch. These devices are enough of a poison pill that you're better off without them. You can problem block them with Pihole, but you're one update away from either circumventing the Pihole, or breaking your IoT device because something got changed on the manufacturer's end.
    - gruez 4y ago
      At that point you're better off not connecting the device to the internet at all.
      - bee_rider 4y ago
        I think we might be at that point currently.
  - rsync 4y ago
    No - as I’ve said upthread, the real evil is running DoH on the www host. Now what ?
teeray 4y ago
DNAT ftw
dylan604 4y ago
Can you not just block the specific addresses? Sure, you'll probably have to do some log digging to find out which ones, but I'm guessing someone else on the internet has already done it.
- Gigachad 4y ago
  Sure, then the devices throw up an error and refuse to function. I noticed that most smart TV streaming apps refused to run if they failed to connect to their ad servers.
n4bz0r 4y ago
> I wonder how people are thinking about solving this problem. Not sure what potential issues are are being mentioned here, but I'd say a separate VLAN for IoT devices + QoS [0] should rule out most of the concerns. [0] https://en.m.wikipedia.org/wiki/Quality_of_service https://en.m.wikipedia.org/wiki/Quality_of_service
DistractionRect 4y ago
I solve this with a DNS based firewall. Essentially it's just DNS filtering on steriods. You start with an empty (or preseeded) ipset, and a firewall rule that says to reject/drop all outbound traffic if the destination isn't in the ipset. Dnsmasq is setup as the default dns provider in DHCP, and it's setup to add all resolved IPs to the ipset (with an expiration so stale entries get removed). Then it's just DNS filtering per the usual. DoH, DoQUIC, DoT, etc don't work as their hardcoded IPs are blocked by default, and DNS filtering knocks out domain resolution of the endpoints. Even if an alternate resolver is allowed through the firewall, none of it's responses get into the ipset, so it's still broken (and is a sign I need to update the DNS filter). Works a treat on my IoT devices
- BLKNSLVR 4y ago
  I really like the concept of this approach, I'd say it's worth writing a blog post / article describing the process and details so others can duplicate it.
- afraca 4y ago
  This is very very similar to something developed by SIDN labs called "DNS Resolution Required", you can read the blog post here: https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-required-can-help-make-the-internet-safer https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-req...
anthropodie 4y ago
You solve that by not buying such crap-ware. You buy open hardware systems.
- ghostpepper 4y ago
  I would love if there was an open 4K HDR TV but I think only a very niche audience actually cares about this so most manufacturers will not see a market opportunity
  - throwaway2037 4y ago
    I see your point. Real question: In today's world, what is the difference between a TV and a computer monitor + RasPi? I guess the biggest issue will be streaming on services with very strict operating system / browser requirements. For example, can you stream Netflix @ 4K via RasPi? I assume no, due to super strict DRM. It is a little bit surprising to me that the big streaming companies have not creating an open source operating system (similar to Android) that can be used by manuf to create TVs. Then, smaller manuf can find ways to offer bloatware- / adware-free options. Maybe this already exists, and this comment makes no sense!
    - krageon 4y ago
      Size. You cannot get the quality and size of a TV in a monitor form factor.
    - piperswe 4y ago
      Size, OLED, HDR, and eARC are three things I can't find in a monitor. I don't know of any 55" OLED monitors that support Dolby Vision and can output their audio to my home audio system over eARC. OLED and Dolby Vision are important to me because HDR makes such a huge difference in properly mastered content. eARC is important because my audio system is able to take advantage of Dolby Atmos metadata and I don't want to lose that. I could just pass my HDMI inputs through my receiver, but my receiver doesn't support passing through 4k 120Hz which I appreciate using with my Xbox. HDR and OLED are available in some monitor models, but to my knowledge there aren't any 55" monitors with HDR and OLED, and especially eARC.
zeroflow 4y ago
There is a workaround by enabling NAT and forcing all traffic to piHole / pfblockerNG https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html https://docs.netgate.com/pfsense/en/latest/recipes/dns-redir...
- rsync 4y ago
  How does this help with DoH? If the dns request is over 443 and the DoH server is the same host as the served resource, what can be done ?
  - jamiek88 4y ago
    Could you MITM and inspect for dns request packets?
    - rsync 4y ago
      Yes - I postulated this elsewhere in this thread. The next step in the arms race would then be to implement DoHoH. Sigh.
asix66 4y ago
I couple PiHole with a pfsense router. In pfsense all DNS queries are blocked except to my pihole. This thwarts an IoT device or streaming devices, etc., from bypassing pihole. Then I block known DoH servers on both pfsense and pihole---which is not perfect, since it's really a game of whack-a-mole, but better than not.
mmcnl 4y ago
It's already happening, but hardcoding also causes other issues. You have to be really big before you can depend on a hardcoded DNS server.
RachelF 4y ago
Microsoft already does this in Windows 8, 10 and 11 with their "telemetry" servers. The DNS queries for these bypass any of your own DNS settings. They even bypass host file overrides.
- no_time 4y ago
  On the upside, the endpoints are nicely documented by both MS and independent researchers. Also, Windows enforces packet filtering rules on it's own phoning home so a well configured firewall like SimpleWall will be relatively secure from a spying perspective. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Workpackage4_Telemetry.pdf https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall
heavyset_go 4y ago
Already happening, Google products like the Chromecast serve up plenty of obnoxious ads these days, and hardcode Google DNS. Even blocking Google DNS still allows ads to get through. This is a big reason why I will never buy another Chromecast branded product, or Google product, again. Congratulations on successfully monetizing my time and annoying me into swearing off Google products altogether.
e2le 4y ago
> Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole. > Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely. On average, Smart TVs generate an average of 60 megabytes of outgoing Internet traffic per day, all the while bypassing tools like PiHole. https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole For those devices which ignore DHCP/NDP provided DNS addresses, you could create a firewall to redirect outgoing port 53 traffic to your own server.

Group_B 4y ago

One of many reasons why I don’t even bother with IoT devices. Don’t need all this crap to be connected to wifi. There was nothing wrong with it before.

Deritiod 4y ago
It's not crap just because you don't see a benefit. In my opinion, additional being a curios software engineer I find it quite interesting. Necessary? Perhaps not but helpful. Heating valves for example.
- aksss 4y ago
  Not that I’m terribly experienced with it, but a lot of home automation can be done without “IoT” — specifically without the crapware Trojan controllers that come with consumer solutions from Best Buy. ISY994 for example. Easy solutions for remote access via apps (vpn to home) and notifications as well. It’s not as easy to set up as a plug and play controller from Google, but it’s far more private.
  - Deritiod 4y ago
    I include your example. The definition of iot from Wikipedia also does it. But honestly why I hate my iot window blinds device it's the perfect excuse to use vlan at home.

lapser 4y ago

This is already happening. The likes of Google Home et al already hardcode their own servers. I noticed that no DNS requests were being made through my Pi Hole, so when I looked, it turned out their DNS servers were hardcoded. However, I'm more worried about when they start hardcoding DoH servers.

doubled112 4y ago
Same on DoH. I can’t filter it or redirect it like I can with plain old DNS.
- lapser 4y ago
  Yes, really the only way would be to set up a MITM proxy on your network and enforce all traffic goes through that. Also means accepting a CA.
  - 1vuio0pswjnm7 4y ago
    Been using this solution myself for a number of years. Works remarkably well. I do not even use DNS recursion or any remote DNS requests because I can load bulk DNS data into the proxy's memory. There is only ever one nonrecursive request to a localhost authoritative DNS server and the answer is always the same: the address of the proxy. Ironically perhaps, DoH outside the browser can be used to gather the bulk DNS data, thanks to HTTP/1.1 pipelining. Many years ago I anticipated that "developers" would no longer allow end users to choose DNS servers. The developers' work, i.e., software, was dropping in market value and they began to adopt a Trojan Horse "business model". End users could use the software for free with the expectation that few would notice/complain about increased surveillance and data collection, or injected advertising. The so-called "MITM proxy" is neither a new nor radical idea. Corporations routinely "MITM" TLS traffic from their networks. Enterprise hardware/software companies have provided turnkey solutions. The issue is not limited to addresses for DNS servers. For example, WhatsApp hardcodes IP addresses in their mobile app. For that problem I use an application firewall. The PiHole is essentially a slightly modified version of dnsmasq running on a RPi. It is funny that no one has tried using other DNS software. Given a choice of DNS software, I would not choose dnsmasq. It also still seems that no one has presented a "PiHole" that uses a forward proxy instead of a DHCP/DNS server. Similar to corporations, home users need a turnkey solution for monitoring their home networks.
    - ClumsyPilot 4y ago
      " Similar to corporations, home users need a turnkey solution for monitoring their home networks." You'd think thats thr job of the router companies - they sell you hex-core routers for $390 or whatecer, but no usefull functionality

timbit42 4y ago

Have your gateway/firewall block all traffic from the LAN IP of the device from exiting the LAN. If it's running on Win/Mac/Linux/Android/iOS, block the app from talking to the gateway, or even the entire LAN.

pdimitar 4y ago
That's what I do with my printer. I love the company (Brother) and they make IMO the best printers and MFPs but I am quite paranoid already and I just block any WAN traffic. The printer is (and should be) really only used from the LAN anyway.

phillipseamore 4y ago

I already translate all port 53 traffic to my local resolver and block known DoH addresses.

gruez 4y ago
If they're really evil, they'd proxy all traffic through a single host (eg. d2v3i0u0qtn52v.cloudfront.net), so you have to choose between no IOT features, or getting subjected to all the ads/telemetry.
- everdrive 4y ago
  >so you have to choose between no IOT features I'll bring out the fainting couch. These devices are enough of a poison pill that you're better off without them. You can problem block them with Pihole, but you're one update away from either circumventing the Pihole, or breaking your IoT device because something got changed on the manufacturer's end.
  - gruez 4y ago
    At that point you're better off not connecting the device to the internet at all.
    - bee_rider 4y ago
      I think we might be at that point currently.
- rsync 4y ago
  No - as I’ve said upthread, the real evil is running DoH on the www host. Now what ?

teeray 4y ago

DNAT ftw

dylan604 4y ago

Can you not just block the specific addresses? Sure, you'll probably have to do some log digging to find out which ones, but I'm guessing someone else on the internet has already done it.

Gigachad 4y ago
Sure, then the devices throw up an error and refuse to function. I noticed that most smart TV streaming apps refused to run if they failed to connect to their ad servers.

n4bz0r 4y ago

> I wonder how people are thinking about solving this problem. Not sure what potential issues are are being mentioned here, but I'd say a separate VLAN for IoT devices + QoS [0] should rule out most of the concerns. [0] https://en.m.wikipedia.org/wiki/Quality_of_service https://en.m.wikipedia.org/wiki/Quality_of_service

DistractionRect 4y ago

I solve this with a DNS based firewall. Essentially it's just DNS filtering on steriods. You start with an empty (or preseeded) ipset, and a firewall rule that says to reject/drop all outbound traffic if the destination isn't in the ipset. Dnsmasq is setup as the default dns provider in DHCP, and it's setup to add all resolved IPs to the ipset (with an expiration so stale entries get removed). Then it's just DNS filtering per the usual. DoH, DoQUIC, DoT, etc don't work as their hardcoded IPs are blocked by default, and DNS filtering knocks out domain resolution of the endpoints. Even if an alternate resolver is allowed through the firewall, none of it's responses get into the ipset, so it's still broken (and is a sign I need to update the DNS filter). Works a treat on my IoT devices

BLKNSLVR 4y ago
I really like the concept of this approach, I'd say it's worth writing a blog post / article describing the process and details so others can duplicate it.
afraca 4y ago
This is very very similar to something developed by SIDN labs called "DNS Resolution Required", you can read the blog post here: https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-required-can-help-make-the-internet-safer https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-req...

anthropodie 4y ago

You solve that by not buying such crap-ware. You buy open hardware systems.

ghostpepper 4y ago
I would love if there was an open 4K HDR TV but I think only a very niche audience actually cares about this so most manufacturers will not see a market opportunity
- throwaway2037 4y ago
  I see your point. Real question: In today's world, what is the difference between a TV and a computer monitor + RasPi? I guess the biggest issue will be streaming on services with very strict operating system / browser requirements. For example, can you stream Netflix @ 4K via RasPi? I assume no, due to super strict DRM. It is a little bit surprising to me that the big streaming companies have not creating an open source operating system (similar to Android) that can be used by manuf to create TVs. Then, smaller manuf can find ways to offer bloatware- / adware-free options. Maybe this already exists, and this comment makes no sense!
  - krageon 4y ago
    Size. You cannot get the quality and size of a TV in a monitor form factor.
  - piperswe 4y ago
    Size, OLED, HDR, and eARC are three things I can't find in a monitor. I don't know of any 55" OLED monitors that support Dolby Vision and can output their audio to my home audio system over eARC. OLED and Dolby Vision are important to me because HDR makes such a huge difference in properly mastered content. eARC is important because my audio system is able to take advantage of Dolby Atmos metadata and I don't want to lose that. I could just pass my HDMI inputs through my receiver, but my receiver doesn't support passing through 4k 120Hz which I appreciate using with my Xbox. HDR and OLED are available in some monitor models, but to my knowledge there aren't any 55" monitors with HDR and OLED, and especially eARC.

zeroflow 4y ago

There is a workaround by enabling NAT and forcing all traffic to piHole / pfblockerNG https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html https://docs.netgate.com/pfsense/en/latest/recipes/dns-redir...

rsync 4y ago
How does this help with DoH? If the dns request is over 443 and the DoH server is the same host as the served resource, what can be done ?
- jamiek88 4y ago
  Could you MITM and inspect for dns request packets?
  - rsync 4y ago
    Yes - I postulated this elsewhere in this thread. The next step in the arms race would then be to implement DoHoH. Sigh.

asix66 4y ago

I couple PiHole with a pfsense router. In pfsense all DNS queries are blocked except to my pihole. This thwarts an IoT device or streaming devices, etc., from bypassing pihole. Then I block known DoH servers on both pfsense and pihole---which is not perfect, since it's really a game of whack-a-mole, but better than not.

mmcnl 4y ago

It's already happening, but hardcoding also causes other issues. You have to be really big before you can depend on a hardcoded DNS server.

RachelF 4y ago

Microsoft already does this in Windows 8, 10 and 11 with their "telemetry" servers. The DNS queries for these bypass any of your own DNS settings. They even bypass host file overrides.

no_time 4y ago
On the upside, the endpoints are nicely documented by both MS and independent researchers. Also, Windows enforces packet filtering rules on it's own phoning home so a well configured firewall like SimpleWall will be relatively secure from a spying perspective. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Workpackage4_Telemetry.pdf https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall

heavyset_go 4y ago

Already happening, Google products like the Chromecast serve up plenty of obnoxious ads these days, and hardcode Google DNS. Even blocking Google DNS still allows ads to get through. This is a big reason why I will never buy another Chromecast branded product, or Google product, again. Congratulations on successfully monetizing my time and annoying me into swearing off Google products altogether.

e2le 4y ago

> Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole. > Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely. On average, Smart TVs generate an average of 60 megabytes of outgoing Internet traffic per day, all the while bypassing tools like PiHole. https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole For those devices which ignore DHCP/NDP provided DNS addresses, you could create a firewall to redirect outgoing port 53 traffic to your own server.