5 ms·

Note: can bring down a DNSSEC-validating DNS resolver. Not any authoritative DNS server. Most people already use a centralized resolver like Google or Cloudfl

by teddyh 3y ago

Note: can bring down a DNSSEC-validating DNS resolver. Not any authoritative DNS server. Most people already use a centralized resolver like Google or Cloudflare anyway, and you can be sure those will be patched. People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new?

systems_glitch 3y ago
I bet it'll still manage to serve ad pages instead of NXDOMAIN, though. Actually that's what will get them to patch up.
- wtallis 3y ago
  Isn't the ads-instead-of-NXDOMAIN attack the one thing DNSSEC is actually good at protecting against? So I would expect the guilty ISPs to avoid providing any form of DNSSEC support whatsoever, and thereby avoid consequences of any of DNSSEC's downsides.
  - tptacek 3y ago
    No, DNSSEC does nothing about ads-instead-of-NXDOMAIN. DNSSEC is server-to-server. If you rely on your ISP's resolver server, they can ignore DNSSEC and feed you whatever they want. If you run your own validating recursing resolver, you don't have the ads-instead-of-NXDOMAIN problem in the first place.
    - wtallis 3y ago
      Who relies directly on their ISP's DNS servers? Isn't the ordinary use (for residential networks, who are the targets of the attacks in question) that your router is running dnsmasq and handing out DHCP leases that instruct hosts to query that dnsmasq instance?
      - londons_explore 3y ago
        but that dnsmasq instance is configured by default to consult the ISP's DNS servers by default as upstream.
        wtallis 3y ago
        Right, but it has a DNSSEC option that when switched on can protect against this attack (provided the ISP isn't stripping all DNSSEC info from their replies), at the cost of suffering the other consequences of attempting DNSSEC validation. Not a great solution overall, but it does exist.
        tptacek 3y ago
        Look, you're either recursing or you're not. If you're not recursing, you're not really validating DNSSEC records. If you are, you're not vulnerable to NXDOMAIN ads. The NXDOMAIN thing is in fact not a good use case for DNSSEC. That's all I'm saying here, I'm not making any broader claim than that. Of course you can just install a recursive resolver on your router. But then you don't need DNSSEC!
        xz53 3y ago
        > If you're not recursing, you're not really validating DNSSEC records. Nope, validating in stubs is a thing. systemd's resolved does it. Apple's high-level network frameworks do it if you ask as of a couple of years ago (they've been back and forth on DNSSEC in their lower level API for longer than that). I'm not sure how well they work but they're there.
        tptacek 3y ago
        A validating stub resolver is effectively a recursive resolver proxying through another recursor. At the point where you're going to do that, you might as well just run a recursive server. Either way: you don't have the NXDOMAIN problem. I really don't think there's a way to get around this. It's not dispositive of DNSSEC (other things are!), it's just not a real use case?
quickthrower2 3y ago
That is quite a stretch to get to that “meh”. I don’t even use 1.1.1.1 etc. and I am a HNer.
- icedchai 3y ago
  Same. I've been running my own DNS servers (caching and authoritative) since the mid 90's, back when my home network was on an ISDN line. I still use BIND.
- 8organicbits 3y ago
  Lots of people use 1.1.1.1 without knowing it. Firefox, for example, uses DoH by default. The default resolver for the US is Cloudflare. https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-our-rollout-of-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https#... Chrome followed: https://duo.com/decipher/google-makes-dns-over-https-default-in-chrome https://duo.com/decipher/google-makes-dns-over-https-default...
tentacleuno 3y ago
> People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new? Bear in mind that if you're using a regular port 53 resolver like Google's, you might be using your ISP's resolver anyway -- a lot of ISP's hijack port 53 and redirect it to their own server(s) to reduce load. That's why DNS over TLS / HTTPS is typically recommended over unencrypted DNS.
- ptk 3y ago
  Do you have examples of ISPs that do this?
  - tptacek 3y ago
    Worth noting that an ISP that does this --- literally intercepting all port 53 traffic, TCP and UDP --- can just strip DNSSEC, too.
  - KevinGlass 3y ago
    In the US, Comcast does this on all business copper connections. They call it "Secure Edge". It frequently breaks DNS, VPNs, some voip, torrents (or any P2P connections), and probably other stuff. It's enabled by default on all new accounts and will randomly be at the account level. To disable it you have to call them and ask.
  - buro9 3y ago
    In the UK most ISPs do this, it's their primary mechanism for enforcing any legal blocks against websites.
- deleted 3y ago
  [deleted]
- cma 3y ago
  How much does that reduce load, isn't it fairly miniscule bandwidth compared with non-colocated video streaming etc.?
  - 3y ago
TacticalCoder 3y ago
> Most people already use a centralized resolver like Google or Cloudflare anyway, ... This is HN. I run unbound on a Pi (mentioning the Pi I don't know if those running PiHole are running a vulnerable resolver or not). My Pi shall need patching when I get back from vacation!
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

by teddyh 3y ago

systems_glitch 3y ago

I bet it'll still manage to serve ad pages instead of NXDOMAIN, though. Actually that's what will get them to patch up.

wtallis 3y ago
Isn't the ads-instead-of-NXDOMAIN attack the one thing DNSSEC is actually good at protecting against? So I would expect the guilty ISPs to avoid providing any form of DNSSEC support whatsoever, and thereby avoid consequences of any of DNSSEC's downsides.
- tptacek 3y ago
  No, DNSSEC does nothing about ads-instead-of-NXDOMAIN. DNSSEC is server-to-server. If you rely on your ISP's resolver server, they can ignore DNSSEC and feed you whatever they want. If you run your own validating recursing resolver, you don't have the ads-instead-of-NXDOMAIN problem in the first place.
  - wtallis 3y ago
    Who relies directly on their ISP's DNS servers? Isn't the ordinary use (for residential networks, who are the targets of the attacks in question) that your router is running dnsmasq and handing out DHCP leases that instruct hosts to query that dnsmasq instance?
    - londons_explore 3y ago
      but that dnsmasq instance is configured by default to consult the ISP's DNS servers by default as upstream.
      - wtallis 3y ago
        Right, but it has a DNSSEC option that when switched on can protect against this attack (provided the ISP isn't stripping all DNSSEC info from their replies), at the cost of suffering the other consequences of attempting DNSSEC validation. Not a great solution overall, but it does exist.
        tptacek 3y ago
        Look, you're either recursing or you're not. If you're not recursing, you're not really validating DNSSEC records. If you are, you're not vulnerable to NXDOMAIN ads. The NXDOMAIN thing is in fact not a good use case for DNSSEC. That's all I'm saying here, I'm not making any broader claim than that. Of course you can just install a recursive resolver on your router. But then you don't need DNSSEC!
        xz53 3y ago
        > If you're not recursing, you're not really validating DNSSEC records. Nope, validating in stubs is a thing. systemd's resolved does it. Apple's high-level network frameworks do it if you ask as of a couple of years ago (they've been back and forth on DNSSEC in their lower level API for longer than that). I'm not sure how well they work but they're there.
        tptacek 3y ago
        A validating stub resolver is effectively a recursive resolver proxying through another recursor. At the point where you're going to do that, you might as well just run a recursive server. Either way: you don't have the NXDOMAIN problem. I really don't think there's a way to get around this. It's not dispositive of DNSSEC (other things are!), it's just not a real use case?

quickthrower2 3y ago

That is quite a stretch to get to that “meh”. I don’t even use 1.1.1.1 etc. and I am a HNer.

icedchai 3y ago
Same. I've been running my own DNS servers (caching and authoritative) since the mid 90's, back when my home network was on an ISDN line. I still use BIND.
8organicbits 3y ago
Lots of people use 1.1.1.1 without knowing it. Firefox, for example, uses DoH by default. The default resolver for the US is Cloudflare. https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-our-rollout-of-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https#... Chrome followed: https://duo.com/decipher/google-makes-dns-over-https-default-in-chrome https://duo.com/decipher/google-makes-dns-over-https-default...

tentacleuno 3y ago

> People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new? Bear in mind that if you're using a regular port 53 resolver like Google's, you might be using your ISP's resolver anyway -- a lot of ISP's hijack port 53 and redirect it to their own server(s) to reduce load. That's why DNS over TLS / HTTPS is typically recommended over unencrypted DNS.

ptk 3y ago
Do you have examples of ISPs that do this?
- tptacek 3y ago
  Worth noting that an ISP that does this --- literally intercepting all port 53 traffic, TCP and UDP --- can just strip DNSSEC, too.
- KevinGlass 3y ago
  In the US, Comcast does this on all business copper connections. They call it "Secure Edge". It frequently breaks DNS, VPNs, some voip, torrents (or any P2P connections), and probably other stuff. It's enabled by default on all new accounts and will randomly be at the account level. To disable it you have to call them and ask.
- buro9 3y ago
  In the UK most ISPs do this, it's their primary mechanism for enforcing any legal blocks against websites.
deleted 3y ago
[deleted]
cma 3y ago
How much does that reduce load, isn't it fairly miniscule bandwidth compared with non-colocated video streaming etc.?
- 3y ago

TacticalCoder 3y ago

> Most people already use a centralized resolver like Google or Cloudflare anyway, ... This is HN. I run unbound on a Pi (mentioning the Pi I don't know if those running PiHole are running a vulnerable resolver or not). My Pi shall need patching when I get back from vacation!

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]