6 ms·
I don't get it... why would a router block access to the entire internet because it can't talk to the manufacturer's servers? Why is it talking to the manufactu
by finnn 12y ago
I don't get it... why would a router block access to the entire internet because it can't talk to the manufacturer's servers? Why is it talking to the manufacturer's servers at all?
- sp332 12y agoIt didn't shut off all internet access. The DNS resolver on the router checked for connectivity. If it couldn't resolve Belkin's domain, it disabled the DNS service because it assumed the Internet wasn't really connected. Edit: see the workaround here https://belkininternationalinc.statuspage.io/ https://belkininternationalinc.statuspage.io/
- smsm42 12y agoOK, this is much less scary than I thought reading the article. Probably wouldn't hurt to diversify it a bit and use some major provider like Google or Amazon (or both?) for the check, but at least it doesn't look as bad as the vague description in the article that made me think some vital router functions and not simple DNS check depend on external infrastructure.
- sp332 12y agoFor most people, DNS on the router is vital because they don't know how to get online without it.
- deleted 12y ago[deleted]
- staunch 12y agoIt shouldn't be less scary. Any time proprietary software calls home it could receive orders to open a backdoor or anything else. It's a command and control feature disguised as a DNS check, or at the very least it could be easily turned into one at any point without raising suspicion.
- smsm42 12y agoI think you're being too paranoid here (I don't say this often :). A ping to known good host is a benign thing. Can it be replaced with malicious thing? I'm sure it can, somebody could gain access to your router and reflash it with malware and you wouldn't even know. This is a real possibility. But it remains so regardless of presence or absence of DNS ping, so DNS ping by itself does not add any specific threat.
- staunch 12y agoCalling it a "DNS ping" is just confusing or wrong. It's a DNS query. It's dangerous because: 1. It allows them to create a database with the IP address of every internet-connected router. 2. It allows them to control routers via DNS packets, which are frequently permitted even behind firewalls. 3. It providers a cover for traffic to their servers on the DNS port. This kind of thing is very common. It's also very dangerous and we should demand alternatives.
- smsm42 12y agoI called it DNS ping because it essentially serves the same function as "ping" command but on slightly different level - by checking if DNS functions. 1. This is true, but most routers check for firmware updates anyway, so there you go. Not to mention online warranty registrations, etc. which would get you into their DB anyway. 2. Unlikely, unless you have a RCE bug in your DNS implementation, in which case the router is toast without the DNS querying. 3. One query is not "traffic". It is pretty easy to distinguish between one query on boot and constant communication. Again, it is only relevant if you already have malware in your router.
- staunch 12y ago#1 and #3 are not even refutations and #2 you didn't even understand. You're absolutely wrong that this isn't a security issue. The simple proof is that no secure network would ever allow a device to call home like this. Maybe you think that because it's common it's not a problem. That's not how security works.
- andyjohnson0 12y agoAmazon/Google might be a little annoyed if every Belkin router on the planet started pinging them.
- darkstar999 12y agoThey would love it. Why do you think they provide public DNS in the first place?
- vertex-four 12y agoGoogle provide public DNS because they think they can make people's DNS faster and more reliable, which causes web pages to load faster and more reliably, causing Internet users to be happier when using the Internet, and therefore providing more analytics data and ad revenue to Google.
- deleted 12y ago[deleted]
- gonzo 12y agoand, they know where people are looking/surfing/...
- smsm42 12y agoThey probably get much more legit traffic than that. Router doesn't need to do it that frequently, only when it needs to find out if internet connection is alive. Which is usually on boot and maybe on infrequent occasions after that. So they wouldn't even notice.
- davidu 12y agoNo. Terrible idea: http://pages.cs.wisc.edu/~plonka/netgear-sntp/ http://pages.cs.wisc.edu/~plonka/netgear-sntp/
- Igglyboo 12y ago>some vital router functions and not simple DNS check How do you expect 99.99% of the world to get to facebook.com without DNS? It's pretty damn vital if you ask me, especially for a consumer grade router.
- smsm42 12y agoBut their DNS doesn't actually depend on that server (at least according to the explanation above). Only the part of the code checking "do we have internet?" depends on it, and only because they use some internal company's address and apparently whoever is responsible for it doesn't know that if this host ever gets down it breaks the internet for all Belkin customers. So it's a simple case of miscommunication and failure to think systemically, not something fundamentally broken.
- mzs 12y agoDo a dig of heartbeat.belkin.com and you get a bunch of 54.0.0.0/8 addresses that Amazon bought from Merck. It's using AWS.
- smsm42 12y agoLooks good, but how comes then it still didn't work properly? I see only two possibilities: somebody managed to mess up all the redundant servers at once, by either messing up firewall rules or replicated config or something like that, or somebody messed up heartbeat.belkin.com. DNS entry.
- mzs 12y agoLooks like I was wrong cause I checked too late, Belkin moved to AWS as part of the fix, doh! https://news.ycombinator.com/item?id=8429789 https://news.ycombinator.com/item?id=8429789
- cbhl 12y agoRunning your own servers for Internet checks is what you're supposed to do -- when you don't, you cause problems for other people (e.g. if Google decided to sell an address block or change its DNS name or if someone decides to deprecate an NTP pool server). For example, look at the document made by the NTP Pool: http://www.pool.ntp.org/en/vendors.html http://www.pool.ntp.org/en/vendors.html. Microsoft has time.windows.com, Apple has time.apple.com, and Canonical has ntp.ubuntu.com. I recall reading a story where someone checked network connectivity by pinging a DNS name with a known but invalid IP address, and relying on the exact error message. When a sysadmin later removed the "invalid" DNS entry, ping would return a different error message, which caused the network connectivity check to fail. People do strange things for connectivity checks -- what Belkin did here seems pretty "by-the-book" by comparison.
- mst 12y agoThis is why when I want to implement a negative connectivity check I always make a deal with admins to have a will-never-exist.whatever.com or similar record with known and documented behaviour. Yes, that's because I've been caught out before :)
- jobu 12y agoHanlon's Razor seems to fit this debacle fairly well: "Never attribute to malice that which is adequately explained by stupidity."
- 001sky 12y agoHumans are rarely stupid, unfortunately. Better to remain 'agnostic'
- opendais 12y agoRarely? Can I live in your reality? <3
- 001sky 12y agoThere are two kinds of people in the world: (1) Those who say 'this is stupid'; and (2) Those who say "oh, i get it" Rarely do they coincide empirically.
- jessaustin 12y agoIn any reality, humans are ingenious at things you don't want them to do.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- andrewrice 12y agoMost routers monitor manufacturer servers for firmware updates, I believe.
- valarauca1 12y agoI hope the router implements TLS to transfer the firmware. Otherwise, that certainly isn't a massive attack vector.
- lucb1e 12y agoI'm undecided whether this should be opt-in or opt-out, but it surely shouldn't break the router if something upstream breaks.
- ibrahima 12y agoA friend of mine has a newer Belkin router. It's actually kind of handy in the case that your cable/DSL modem is screwing up because the router will tell you that something is wrong with your connection. But I think it should probably have some "I'm sure my internet is fine, please continue" button or something.
- kevind23 12y agoSure, on the router configuration page, I get that it might inform you that you don't have a connection. But (a) why only contact one company server? can't they ping anything else? and (b) why would you disable DNS if you suspect a problem with the connection? surely if there were a problem, the addresses wouldn't resolve and the result would be the same