7 ms·

Chrome connects to three random domains at startup

349 points by tbassetto 15y ago

senthilnayagam 15y ago
I know one thing chrome leaks memory badly in OSX lion, not sure if these magic things happening in background has something to do with it
fourstar 15y ago
No wonder I've been seeing youporn.com in my history.
unseen 15y ago
Neat feature. In my opinion, they should go even further and make use of the information and inform the user, too: "Your ISP (network administrator, ..) is intercepting and manipulating DNS requests. Do you want to use Google DNS instead?" Comes in real handy when we need to have a "DnsManipulationDetector" in the future that checks if your DNS is actively censoring...
- dustingetz 15y ago
  the environments where this is a problem - frequent one-word hosts - are intranets where you want to use the intranet DNS.
- codeka 15y ago
  If your ISP is manipulating DNS like that, it's also possible that they're blocking UDP/53 to any host other than their own DNS servers as well. Though it's certainly worth a shot, and I suppose Chrome could probably do a test query to 8.8.8.8 before recommending the switch.
- RexRollman 15y ago
  Some people who probably view that with antitrust concerns, even though I agree that would be a good idea.
- gioele 15y ago
  > "Your ISP (network administrator, ..) is intercepting and manipulating DNS requests. Do you want to use Google DNS instead?" I would prefer "Your ISP (network administrator, ..) is intercepting and manipulating DNS requests. Do you want to install a local caching DNS server and use it instead?" Unbound [1] is a local DNS server that I have installed on all my machines. Small, fast, security-oriented, IPv6, BSD, made by NLnet Labs. [1] http://unbound.net/ http://unbound.net/
  - lmm 15y ago
    So you'd install a local caching DNS server that only chrome would use... and this is better than chrome doing its own DNS lookups how?
    - gioele 15y ago
      The grandparent said "use Google DNS" not "chrome doing its own DNS lookup". If you use Google's DNS (or anybody's DNS) you are basically telling them which sites your are visiting. If you have a local DNS resolver you will not leak all that information to a single third party.
      - lmm 15y ago
        I don't understand. Your local DNS resolver still needs an upstream; either that is your existing broken DNS server, or it's google's DNS server; in either case we're back where we were. Sure, your local DNS resolver could do some caching, but so could chrome; and a local resolver doesn't combine your lookups with those of your neighbours, so you don't get any privacy advantage that way either.
        gioele 15y ago
        > I don't understand. Your local DNS resolver still needs an upstream No, not a single upstream. When my browser asks my server on 127.0.0.1 to lookup news.ycombinator.com it will first contact the root DNS server, then `com` DNS server, then then `ycombinator.com` DNS server. Who knows about the fact that I was looking for `news.ycombinator.com`? only the `ycombinator.com` DNS server. Who knows about the fact that I was looking for `ycombinator.com`? only the `com` DNS server. Now I go to slashdot.org. Who will know about that? Only the `org` DNS server. If you use the Google DNS, Google will know that you requested both `news.ycombinator.com` and `slashdot.org`. Do you want them or any single company to have all these information? Obviously you need an upstream, an authoritative server somewhere. But why do you need to concentrate all these requests on a single DNS server? ISP are actively tracking users and, probably, selling their DNS histories to advertiser. Nominum (makers of a widespread DNS server) is quite explicit about it: «Data gathering and measurement are a vital part of network operations and DNS data represents a rich vein to be mined that has been underutilized in the past». [1] [1] http://www.nominum.com/technology/analytics http://www.nominum.com/technology/analytics
cydonian_monk 15y ago
I noticed this two years ago, and eventually had to stop using Chrome (and Chromium browsers) as it would result in my ISP blocking all DNS requests from my IP (for a seemingly random amount of time). Even requests to public DNS would fail. It took awhile to identify Chrome as the culprit, and I wasn't convinced after seing the bogus DNS requests in TCP traps. So I started a cycle of using/not using Chrome, and it became obvious. The easy solution was to stop using Chrome. The hard solution was to move. I've done both, but have yet to start using Chrome again.
- kmm 15y ago
  I don't understand. Why would your ISP block your IP for bogus DNS requests? And why are they monitoring your traffic to public DNS servers? I presume this means they have to look at all traffic that goes over port 53. Is there a security concern?
  - cydonian_monk 15y ago
    I have no idea why they would want to block it, unless they considered it an attack vector for some reason. It was automatic - after a few of the bogus DNS requests, all DNS/port 53 traffic was dropped. Everything else worked, only DNS failed.
  - brandon 15y ago
    This is common practice if the queries appear to be originating from worms like Conficker, etc. Others have reported that this behavior of Chrome's can set off false IDS alarms for the same reason.
    - windsurfer 15y ago
      And it's also common practice to send all bad DNS queries to an ad-ridden search page. Go figure.
- ohashi 15y ago
  Can you name the ISP?
deleted 15y ago
[deleted]
noturtypeof 15y ago
goowhat? arent they the ones wanting to hack the dns protocol with those opendns spammers some month ago? and now they flood the net with bogus dns because the decided to implement a search feature for idiots inside the url bar? please die google asap.
subwindow 15y ago
This has some interesting ramifications- some network security appliances (I work for a company that makes one) look for suspicious sets of DNS requests that match the Domain Generation Algorithms that malware like Conficker use to find a command and control server. These "random" requests look almost exactly the DGA for Murofet- a Zeus variant. This has caused some problems for us (and other vendors, I would assume) in the form of massive numbers of false positives. In short, it's been kind of a PITA. I wish they wouldn't do this, but it is definitely a tough problem to solve and I can't think of a better approach off of the top of my head. The ultimate culprit is the ISPs that return an A record for a DNS request that really should return NXDOMAIN. These ISPs are essentially breaking the Internet, and we're all just scrambling to put band-aids in place to get it to work again.
- teach 15y ago
  The behavior also causes problems in my workplace, too. I work in a public school, and we use an Internet filter as required by law. One part of the filter is attached to our default DNS server, and it looks up novel domains to see if they ought to be blocked. This lookup is slow. Launching Chrome first thing in the morning takes quite a while, because our DNS server/filter blocks until those 3 random domains fail to resolve. I really wish that I could turn it off, although admittedly our "network" is barely compliant with protocols in the name of filtering.
  - andrewcooke 15y ago
    i suspect that you're using their dns server because it's what is given to you via dhcp, but you can probably configure your own (well, you can certainly configure you own; the problem is it's possible that they are blocking dns requests). for example, set things to use 8.8.8.8 as the dns server (which is google's).
    - teach 15y ago
      No, we can't configure our own. The network settings config is locked out using policy controls.
kamechan 15y ago
if you go to chrome://chrome-urls/ and then down to net-internals, you can get a pretty transparent view of exactly what chrome is doing. plus there's a bunch of other stuff there too.
- junktest 15y ago
  chrome://net-internals/#dns
  - rhplus 15y ago
    It appears that Chrome aggressively prefetches DNS results for most of the links in pages you visit too. It's quite strange to watch as DNS requested for hundreds of domains you haven't even intended to visit start flowing past. The first time I saw it I had to check that nothing unscrupulous was running on my computer...
    - andrewcooke 15y ago
      that's configurable in preferences / under the hood / privacy (the "prediction" option - see https://support.google.com/chrome/bin/answer.py?hl=en&answer=114836 https://support.google.com/chrome/bin/answer.py?hl=en&an...) i have all those disabled and chrome still appears fast to me.
iRobot 15y ago
.. and a really great reason for using open source programs
- basugasubaku 15y ago
  I'm not sure what you meant by that, but the article does in fact link to the relevant source: http://code.google.com/codesearch#OAMlx_jo-ck/src/chrome/browser/intranet_redirect_detector.cc&l=78 http://code.google.com/codesearch#OAMlx_jo-ck/src/chrome/bro...
  - skeletonjelly 15y ago
    That might have been his point - that we were able to find out the reasons why because of it's open source.
clsdaniel 15y ago
Interesting, yesterday I moved to a local caching DNS server (much faster and more reliable than what isp provided), however I forgot to set it to run at start up, first thing I do today is try to get to my gmail account, everything is working ok then I try to enter another site, dns lookup error, then I remembered I had named turned off, which means that chrome may have hardcoded google sites ip addresses or is caching them (which is less probable the other site didn't work).

349 points by tbassetto 15y ago

I know one thing chrome leaks memory badly in OSX lion, not sure if these magic things happening in background has something to do with it

fourstar 15y ago

No wonder I've been seeing youporn.com in my history.

unseen 15y ago

Neat feature. In my opinion, they should go even further and make use of the information and inform the user, too: "Your ISP (network administrator, ..) is intercepting and manipulating DNS requests. Do you want to use Google DNS instead?" Comes in real handy when we need to have a "DnsManipulationDetector" in the future that checks if your DNS is actively censoring...

dustingetz 15y ago
the environments where this is a problem - frequent one-word hosts - are intranets where you want to use the intranet DNS.
codeka 15y ago
If your ISP is manipulating DNS like that, it's also possible that they're blocking UDP/53 to any host other than their own DNS servers as well. Though it's certainly worth a shot, and I suppose Chrome could probably do a test query to 8.8.8.8 before recommending the switch.
RexRollman 15y ago
Some people who probably view that with antitrust concerns, even though I agree that would be a good idea.
gioele 15y ago
> "Your ISP (network administrator, ..) is intercepting and manipulating DNS requests. Do you want to use Google DNS instead?" I would prefer "Your ISP (network administrator, ..) is intercepting and manipulating DNS requests. Do you want to install a local caching DNS server and use it instead?" Unbound [1] is a local DNS server that I have installed on all my machines. Small, fast, security-oriented, IPv6, BSD, made by NLnet Labs. [1] http://unbound.net/ http://unbound.net/
- lmm 15y ago
  So you'd install a local caching DNS server that only chrome would use... and this is better than chrome doing its own DNS lookups how?
  - gioele 15y ago
    The grandparent said "use Google DNS" not "chrome doing its own DNS lookup". If you use Google's DNS (or anybody's DNS) you are basically telling them which sites your are visiting. If you have a local DNS resolver you will not leak all that information to a single third party.
    - lmm 15y ago
      I don't understand. Your local DNS resolver still needs an upstream; either that is your existing broken DNS server, or it's google's DNS server; in either case we're back where we were. Sure, your local DNS resolver could do some caching, but so could chrome; and a local resolver doesn't combine your lookups with those of your neighbours, so you don't get any privacy advantage that way either.
      - gioele 15y ago
        > I don't understand. Your local DNS resolver still needs an upstream No, not a single upstream. When my browser asks my server on 127.0.0.1 to lookup news.ycombinator.com it will first contact the root DNS server, then `com` DNS server, then then `ycombinator.com` DNS server. Who knows about the fact that I was looking for `news.ycombinator.com`? only the `ycombinator.com` DNS server. Who knows about the fact that I was looking for `ycombinator.com`? only the `com` DNS server. Now I go to slashdot.org. Who will know about that? Only the `org` DNS server. If you use the Google DNS, Google will know that you requested both `news.ycombinator.com` and `slashdot.org`. Do you want them or any single company to have all these information? Obviously you need an upstream, an authoritative server somewhere. But why do you need to concentrate all these requests on a single DNS server? ISP are actively tracking users and, probably, selling their DNS histories to advertiser. Nominum (makers of a widespread DNS server) is quite explicit about it: «Data gathering and measurement are a vital part of network operations and DNS data represents a rich vein to be mined that has been underutilized in the past». [1] [1] http://www.nominum.com/technology/analytics http://www.nominum.com/technology/analytics

cydonian_monk 15y ago

I noticed this two years ago, and eventually had to stop using Chrome (and Chromium browsers) as it would result in my ISP blocking all DNS requests from my IP (for a seemingly random amount of time). Even requests to public DNS would fail. It took awhile to identify Chrome as the culprit, and I wasn't convinced after seing the bogus DNS requests in TCP traps. So I started a cycle of using/not using Chrome, and it became obvious. The easy solution was to stop using Chrome. The hard solution was to move. I've done both, but have yet to start using Chrome again.

kmm 15y ago
I don't understand. Why would your ISP block your IP for bogus DNS requests? And why are they monitoring your traffic to public DNS servers? I presume this means they have to look at all traffic that goes over port 53. Is there a security concern?
- cydonian_monk 15y ago
  I have no idea why they would want to block it, unless they considered it an attack vector for some reason. It was automatic - after a few of the bogus DNS requests, all DNS/port 53 traffic was dropped. Everything else worked, only DNS failed.
- brandon 15y ago
  This is common practice if the queries appear to be originating from worms like Conficker, etc. Others have reported that this behavior of Chrome's can set off false IDS alarms for the same reason.
  - windsurfer 15y ago
    And it's also common practice to send all bad DNS queries to an ad-ridden search page. Go figure.
ohashi 15y ago
Can you name the ISP?

deleted 15y ago

[deleted]

noturtypeof 15y ago

goowhat? arent they the ones wanting to hack the dns protocol with those opendns spammers some month ago? and now they flood the net with bogus dns because the decided to implement a search feature for idiots inside the url bar? please die google asap.

subwindow 15y ago

This has some interesting ramifications- some network security appliances (I work for a company that makes one) look for suspicious sets of DNS requests that match the Domain Generation Algorithms that malware like Conficker use to find a command and control server. These "random" requests look almost exactly the DGA for Murofet- a Zeus variant. This has caused some problems for us (and other vendors, I would assume) in the form of massive numbers of false positives. In short, it's been kind of a PITA. I wish they wouldn't do this, but it is definitely a tough problem to solve and I can't think of a better approach off of the top of my head. The ultimate culprit is the ISPs that return an A record for a DNS request that really should return NXDOMAIN. These ISPs are essentially breaking the Internet, and we're all just scrambling to put band-aids in place to get it to work again.

teach 15y ago
The behavior also causes problems in my workplace, too. I work in a public school, and we use an Internet filter as required by law. One part of the filter is attached to our default DNS server, and it looks up novel domains to see if they ought to be blocked. This lookup is slow. Launching Chrome first thing in the morning takes quite a while, because our DNS server/filter blocks until those 3 random domains fail to resolve. I really wish that I could turn it off, although admittedly our "network" is barely compliant with protocols in the name of filtering.
- andrewcooke 15y ago
  i suspect that you're using their dns server because it's what is given to you via dhcp, but you can probably configure your own (well, you can certainly configure you own; the problem is it's possible that they are blocking dns requests). for example, set things to use 8.8.8.8 as the dns server (which is google's).
  - teach 15y ago
    No, we can't configure our own. The network settings config is locked out using policy controls.

kamechan 15y ago

if you go to chrome://chrome-urls/ and then down to net-internals, you can get a pretty transparent view of exactly what chrome is doing. plus there's a bunch of other stuff there too.

junktest 15y ago
chrome://net-internals/#dns
- rhplus 15y ago
  It appears that Chrome aggressively prefetches DNS results for most of the links in pages you visit too. It's quite strange to watch as DNS requested for hundreds of domains you haven't even intended to visit start flowing past. The first time I saw it I had to check that nothing unscrupulous was running on my computer...
  - andrewcooke 15y ago
    that's configurable in preferences / under the hood / privacy (the "prediction" option - see https://support.google.com/chrome/bin/answer.py?hl=en&answer=114836 https://support.google.com/chrome/bin/answer.py?hl=en&an...) i have all those disabled and chrome still appears fast to me.

iRobot 15y ago

.. and a really great reason for using open source programs

basugasubaku 15y ago
I'm not sure what you meant by that, but the article does in fact link to the relevant source: http://code.google.com/codesearch#OAMlx_jo-ck/src/chrome/browser/intranet_redirect_detector.cc&l=78 http://code.google.com/codesearch#OAMlx_jo-ck/src/chrome/bro...
- skeletonjelly 15y ago
  That might have been his point - that we were able to find out the reasons why because of it's open source.

clsdaniel 15y ago

Interesting, yesterday I moved to a local caching DNS server (much faster and more reliable than what isp provided), however I forgot to set it to run at start up, first thing I do today is try to get to my gmail account, everything is working ok then I try to enter another site, dns lookup error, then I remembered I had named turned off, which means that chrome may have hardcoded google sites ip addresses or is caching them (which is less probable the other site didn't work).