4 ms·

Hmm. My parents have one of these. Any advice on how to fix it? "Stop using it" obviously isn't an option. - Does configuring a custom DNS server (like Cloudfl

Hmm. My parents have one of these. Any advice on how to fix it? "Stop using it" obviously isn't an option. - Does configuring a custom DNS server (like Cloudflare one) on your local computers solve it? - On the reddit linked at the bottom of the article, someone mentions you can easily use this tool https://www.mengelke.de/Projekte/FritzBox-JSTool https://www.mengelke.de/Projekte/FritzBox-JSTool to edit the configuration file and change the domain. If that's true, why is the article claiming it's impossible to change?

mmcnl 2y ago
As far as I know, this changes the hostname of the modem, but it doesn't change the DNS suffix in the DHCP server. (PS. I am the author. The article is my understanding of the situation but if I'm wrong on some parts please correct me.)
farhaven 2y ago
> Does configuring a custom DNS server (like Cloudflare one) on your local computers solve it? No. If anything, that'd make it worse. The issue reported in TFA is that Fritz!Boxes by default resolve the domain `fritz.box` to themselves for their admin interface, even if that domain has been registered on the public internet by someone else. If you configure cloudflare, you'll prevent that, which will _always_ get you the potentially attacker controlled DNS results.
- avidiax 2y ago
  There is a 2nd issue. If you have a local machine called "myshare" and you mistype "myhsare", it may resolve to the attacker's machine.
fsckboy 2y ago
>"Stop using it" obviously isn't an option. we're only talking about the cost of a commodity modem, so buy a new modem, disconnect old is a potential solution
- rakamotog 2y ago
  Not exactly, for some ISP's, internet only works with Fitzbox. For other modems, you need to go through months worth of to and fro with ISP to even get them working
- alt227 2y ago
  A lot of ISPs will not give out their configuration options and handshake credentials to force you to use their provided equipment only.
  - h4ckerle 2y ago
    This is not true in germany where FritzBoxes are most prevalent.
- almostnormal 2y ago
  FritzBoxes are used as voip server/bpx, printer server, nas, and home automation. And probably more. (German) telcos provide specific FritzBox configuation instructions (select correct sub-branch of provider and contract kind), adding the quest to get real connection data to the attempt to migrate to anything standardized. Switching to something else is not as easy as buying a new modem for most normal people.
avidiax 2y ago
Block 45.76.93.104 and 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828 at the firewall if possible. Setup a local DHCP server, and don't set the fritz.box search domain. Ensure that DNS-over-HTTP (DoH) is enabled where it can be. Set upstream DNS servers that block malware, such as 1.1.1.2 or NextDNS Delete "fritz.box" from the domain search list in DNS settings. Educate your parents to be cautious about directly typing domain names or searching from the OmniBox. https://nextdns.io/ https://nextdns.io/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families...
- hcurtiss 2y ago
  Caution about directly typing domain names is exactly the opposite of what we've told people for twenty years.
  - avidiax 2y ago
    "Direct dial" was never a good idea. There is a class of internet users that doesn't use a search engine, and instead types things like "usedcarsdetroit.com" in the URL bar until they find something they want. And there is the class that starts with a single word search like "cars", which can't go straight to Google. It instead has to see if "cars.fritz.box" exists, because perhaps there's a server called "cars" on your network. And god forbid that your parent types "bankofmerica.com" instead of using a bookmark or their smart phone app.
    - Scoundreller 2y ago
      Also the class that types “Google” into the browser’s search field (back when it was separate from the URL bar).
- Dalewyn 2y ago
  >Educate your parents to be cautious about directly typing domain names First it was not clicking links. Now it's not typing addresses? Jesus Bloody Christ my dude, maybe it really was a mistake to make sand think.
tapper 2y ago
flash it with OpenWrt

mmcnl 2y ago

As far as I know, this changes the hostname of the modem, but it doesn't change the DNS suffix in the DHCP server. (PS. I am the author. The article is my understanding of the situation but if I'm wrong on some parts please correct me.)

farhaven 2y ago

> Does configuring a custom DNS server (like Cloudflare one) on your local computers solve it? No. If anything, that'd make it worse. The issue reported in TFA is that Fritz!Boxes by default resolve the domain `fritz.box` to themselves for their admin interface, even if that domain has been registered on the public internet by someone else. If you configure cloudflare, you'll prevent that, which will _always_ get you the potentially attacker controlled DNS results.

avidiax 2y ago
There is a 2nd issue. If you have a local machine called "myshare" and you mistype "myhsare", it may resolve to the attacker's machine.

fsckboy 2y ago

>"Stop using it" obviously isn't an option. we're only talking about the cost of a commodity modem, so buy a new modem, disconnect old is a potential solution

rakamotog 2y ago
Not exactly, for some ISP's, internet only works with Fitzbox. For other modems, you need to go through months worth of to and fro with ISP to even get them working
alt227 2y ago
A lot of ISPs will not give out their configuration options and handshake credentials to force you to use their provided equipment only.
- h4ckerle 2y ago
  This is not true in germany where FritzBoxes are most prevalent.
almostnormal 2y ago
FritzBoxes are used as voip server/bpx, printer server, nas, and home automation. And probably more. (German) telcos provide specific FritzBox configuation instructions (select correct sub-branch of provider and contract kind), adding the quest to get real connection data to the attempt to migrate to anything standardized. Switching to something else is not as easy as buying a new modem for most normal people.

avidiax 2y ago

Block 45.76.93.104 and 2001:19f0:6c00:1b0e:5400:4ff:fecd:7828 at the firewall if possible. Setup a local DHCP server, and don't set the fritz.box search domain. Ensure that DNS-over-HTTP (DoH) is enabled where it can be. Set upstream DNS servers that block malware, such as 1.1.1.2 or NextDNS Delete "fritz.box" from the domain search list in DNS settings. Educate your parents to be cautious about directly typing domain names or searching from the OmniBox. https://nextdns.io/ https://nextdns.io/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families...

hcurtiss 2y ago
Caution about directly typing domain names is exactly the opposite of what we've told people for twenty years.
- avidiax 2y ago
  "Direct dial" was never a good idea. There is a class of internet users that doesn't use a search engine, and instead types things like "usedcarsdetroit.com" in the URL bar until they find something they want. And there is the class that starts with a single word search like "cars", which can't go straight to Google. It instead has to see if "cars.fritz.box" exists, because perhaps there's a server called "cars" on your network. And god forbid that your parent types "bankofmerica.com" instead of using a bookmark or their smart phone app.
  - Scoundreller 2y ago
    Also the class that types “Google” into the browser’s search field (back when it was separate from the URL bar).
Dalewyn 2y ago
>Educate your parents to be cautious about directly typing domain names First it was not clicking links. Now it's not typing addresses? Jesus Bloody Christ my dude, maybe it really was a mistake to make sand think.

tapper 2y ago

flash it with OpenWrt