6 ms·
Cloudflare 1.1.1.1 incident on June 27, 2024
- cangeroo 2y agoCould DNS responses have been hijacked as well? Edit: Could this have been used to hijack/create TLS certificates?
- kevindamm 2y agoDepends, do you have DNSSEC enabled?
- mort96 2y agoProbably not, I can't remember the last time I looked at 'resolvectl' output and saw anything other than "DNSSEC: no" on any system so I assume it mostly just doesn't exist in practice
- nightpool 2y agoMore practically: do you have DoH enabled? If you're using Chrome, the answer is probably yes.
- tptacek 2y agoDNSSEC doesn't help here. It doesn't run between stub resolvers and recursers like 1.1.1.1.
- georgyo 2y agoYes, unless you have some sort of protection. Protection could be validating DNSSEC (most likely not) Or using DoH (DNS over HTTPS) or DoT (DNS over TLS)
- terom 2y agoI don't think DNSSEC would help in the common case of non-validating stub resolvers querying a public resolver. My understanding is that the DNS query response from a DNSSEC-validating public recursive resolver doesn't contain the information required for the stub client to validate it, only a single AD bit.
- aaron695 2y agoDoes anyone have a link to a blog that explains why I can't have every DNS entry in a database at home? I don't want a 'you could never get this 1%" because of X straight up. What percentage could I get and why is this not easy?
- djbusby 2y agoWell, the database might be large. Millions of domain names, each with like a dozen (or more) records. (maybe 1k * 30 million domains). But mostly it's about how the DNS changes, a lot. Sites move, geo records, etc. Getting those changes to every household would be a lot of traffic. Before DNS folk were sharing a common /etc/hosts file - and quickly determined there had to be a better way. So, DNS with a dozen root servers that stay fresh, caching down stream.
- ranger_danger 2y agoAlso due to Anycast, DNS servers can/do respond with different addresses depending on who requests it and from where.
- tlb 2y agoLarge for the old days, but a billion names is no longer a big file compared to a AAA game.
- fragmede 2y agoA 30 GiB file is nothing these days.
- thedougd 2y ago1) It's distributed. There's not a single database with all the DNS records in existence. Each zone is responsible for hosting and serving their own records. 2) The TTL for a DNS record can be 0. Edit: 3) AXFR is blocked on 'most' zones. You would need this to know all the records in a zone.
- Avamander 2y ago
- belter 2y agoLet's not forget the core shakiness and trust-based nature of BGP will be our ultimate safeguard against an AGI takeover. Lack of authentication, inherent vulnerabilities to route hijacks and leaks, and reliance on mutual trust rather than verification...If AGI tries to assert global dominance, BGP will be the fail-safe 'red button' to prevent an AI apocalypse.
- Vecr 2y agoIs that actually better than just cutting power to all Internet infrastructure?
- delfinom 2y agoRKPI/ROA uptake is now at 50% which is pretty significant increase in just 2 years. https://radar.cloudflare.com/routing https://radar.cloudflare.com/routing Unfortunately BGP will probably be mostly solid in a few more years. At least solid enough among countries with caring ISPs. Prime for the AGI pickings.
- iscoelho 2y agoRPKI/ROA does not solve BGP hijacking [1]: "Even with RPKI validation enforced, a BGP actor could still impersonate your origin AS and advertise your BGP route through a malicious router configuration." It also would not have prevented the bulk of this issue (as the next AS Path was "1031 262504 267613 13335", and would have been accepted by RPKI) so I am confused why Cloudflare claims it to be the solution. Perhaps Cloudflare's own engineers forgot that RPKI is still insecure? [1] https://blog.cloudflare.com/rpki-details https://blog.cloudflare.com/rpki-details
- magicalhippo 2y agoWas hit by this. Took me some time to figure out what was going on, thanks to PiHole caching entries. Swapped to Quad9[1], been using them since. Was debating setting up my own recursive resolver, but the privacy aspect seemed less than ideal. Damed if you do, damed if you don't kinda. [1]: https://www.quad9.net/ https://www.quad9.net/
- lsllc 2y agoSame here, except with a EdgeRouter (Ubiquiti) DNS caching.
- kayson 2y agoWhat's your privacy concern with a recursive resolver? If you're not using DoH or DoT, your ISP can see everything anyways.
- magicalhippo 2y agoI live in a country where I'm not overly concerned about my ISP. But yeah, it was more that the privacy implications are unclear to me.
- papascrubs 2y agoDid 1.0.0.1 not work? Do people not use the backup resolvers that providers offer? I didn't even know that there was an outage. Cloudflare is much faster than quad9, at least for my connection. Talking like sub 10ms response vs 30+ for other providers. I use Technitium and legacy DNS on my internal network. I have Technitium setup to use DoH to cloudflare for all the requests it makes. Best of both worlds IMO
- magicalhippo 2y agoI admit I hadn't set up 1.0.0.1 but the secondary IPv6 one as backup. Neither worked. I run Pi-hole, haven't noticed any significant difference in speed. But good point, will see if I can find that DNS benchmark tool again.
- lopkeny12ko 2y agoThis article does not explain why AS267613/Eletronet started advertising 1.1.1.1/32.
- iscoelho 2y agoConsidering their 1.1.1.1/32 advertisement was a RTBH (Remotely triggered blackhole), it is likely they advertised the route automatically as a result of DDoS. It is common for ISPs to blackhole (nullroute) an IP address that is experiencing DDoS to protect the rest of the network. In this case, they were learning this route from a peer (not a customer), and should not RTBH under any circumstance, but that boils down to a misconfiguration.
- maybeben 2y agomaybe everyone in the world using the same handful of resolver addresses isn't so great for fault tolerance
- cryptonector 2y agoDJB was right. We should have used Curve 25519 for encryption in DNS itself. Then we wouldn't have needed DoT nor DoH, and we'd still have had a pretty good measure of privacy relative to ISPs and eavesdroppers.
- alvenkim 2y agoAS267613 (Eletronet) and ASN262504 (Nova) using RPKI (ROA) at the time of the incident? Not writed in the post, does anyone know?