Posted by frostbyte7 1 day ago
Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.
And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.
I am speaking here as the owner of a UK ISP (who does not currently do this).
It's sort of an absurd question, the prevalence of such things by ISPs was the literal impetus for DoH and DoT.
This is a good reminder to login and take a look, I wouldn't put it past them to change the setting name and reset the default.
edit: apparently Verizon has zero record of the username I've used for my FIOS account for years (and have saved in my password manager). Their account reset also fails with an error. What a dumpster fire of a company.
https://shkspr.mobi/blog/2021/03/advanced-network-error-sear...
https://dn.org/the-sitefinder-debacle-that-shook-the-interne...
I was thinking about interfering with existing sites.
Some carriers also passed info in these headers to be used to make billing calls to the Telco, such as subscribing to premium services with minimal (if any) consent from the user.
I got stung by this years ago. An ad for mobile ringtones showed up on some news site I visited on my phone, I scrolled past without clicking. Next minute I get a text telling me I've subscribed signed up to a (iirc) $25/month ringtone plan and that it'd show up on my phone bill. It took an hour on the phone to my carrier to block the charges and get a refund. The ringtone company kept messaging me for a year that I needed to contact them and "fix" the issue.
"WHO THE F gave them the right to modify the data in my tcp session!!!!".
Spying on it I assumed but modifying one byte of it? A naively written edi that did not expect that would be completely destroyed.
Probably shouldn't have been so stupid for 15 years already by that point. There is no such thing as the right, there is only the ability.
If someone has the ability to do something, they will. Reputation, right & wrong, none of that actually exists or matters.
I didn't track down if the mechanism was based on dns. Could have been but I don't see why it would have had to be. But I was also not attempting to use any non default dns on that device at that time anyway. Obviously since they are trasporting unencrypted data they could modify it any time simply because it's in their hands.
dns would just be one handy low-hanging-fruit way to detour the data to a convenient dedicated purpose server to do the work. But not special or necessary at all. If they want to do the same thing without hijacking dns, they can with almost not even any difference in total effort.
But the good news is that at least the majority (for now) is against it.
Even outside ideology, plain business sense makes ISPs not want to deal with censorship & co. It's work to do that, hence costs money. But there are also ISPs resisting out of ideology and civic duty.
If you've ever been hit with a "webpage isn't updating" issue when someone else can see it, often it's different DNS servers.
It's best to never use the ISP's DNS servers, regardless of the reason why they might do what they do.
But providers overwriting DNS packets regardless – this is the topic of the article :)
P.S.: And yes, there are ways around this like DNSsec etc.
its usually not nefarious, that is just the simpelest (and usually, not always) wrong explanation.
people who think this is not normal probarbly didnt experience what kind of shit u could find on the pre google pre monitored internet. for sure shit u do not want your kids to find. if u dont understand, then likely u dont have kids and very weird fetishes...
Assuming, you had cues for the gender & intent of the author, which I don't, but otherwise it's even more horrible to think about.
There are of course outliers but most people I know in the field care as much about personal rights & freedom as anyone else. Maybe even a small bit more.
But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.
I have no idea how my coworkers seem to be so insensitive to it.
But I guess that if they let you do it they're probably not competent enough to catch you.
They also do not pay for my device, so it’s only fair I can configure things my own way.
I’m pretty sure the worst that could happen is they would ask me to turn it off.
I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.
Things are crazy now. Our TVs snapshot the stuff we watch; our telephones, watches, and TVs are constantly listening what we say; our PCs have undocumented "remote administration" devices that we can't opt-out; every internet service out there is stealing every data that it physically can and selling it to a long list of organizations, including some military ones...
I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.
The trick is simple: disable DHCP on your router, and activate it on PIHole. As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.
Oh and btw, it's not "DNS Hijacking" it's a "Domain Helper", see: https://feross.org/shame-on-you-comcast/
:-(
Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).
> In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol.
is true, then I'm ... pretty unsold on its usefulness. Anyone wanna ELI5 whether that's untrue or anything's changed in the last decade?
General DNSSEC rationale: <https://www.icann.org/resources/pages/dnssec-what-is-it-why-...>
DNSSEC adoption graph: <https://www.verisign.com/resources/dnssec-tools/dnssec-score...>
<https://www.icann.org/en/engagement-calendar/details/icann-t...>
There are also potential downsides (like someone being able to enumerate your subdomains, if you care about such a thing) and it's often switched off by default on operating systems consumers use.
However, it's the only thing that validates DNS records at this moment. That alone makes it worth enabling, in my opinion. For many domain owners, you only need to tick the checkbox in your registrar's domain control pane. If you use a modern DNS server, it's also one config flag and maybe copy/pasting a handful of fields away.
I'll gladly turn off DNSSEC the moment we come up with something better. DoT/DoH doesn't solve the same problem and no real solutions seem to have been proposed. That said, modernisation efforts are still being done. Smaller keys and modern cryptography rather than the massive RSA ones for instance.
Out of curiosity I enabled DNSSEC checking beginning this year. I mostly noted nothing in my browsing. However, with 2 services I noted obscure problems that worked only partially. Some Jira plugins and Swedish railway SJ. I needed to excempt some of their domains from being checked to use their services. Of course you waste a couple of hours every time it happens because you don't think of DNSEC first when some web-based services behaves weirdly. There might be more requests not served to my browser, but I just never noticed or bothered to debug.
So not fit for general use. And even as an experienced developer it's not easy to understand why an exception would be needed. A bug in systemd? Incorrect data in DNS? A real attack?
Edit: I don't use standard DNS on port 53 at all. Blocked outgoing requests on that port. Everything DoH or DoT. Of course I need to trust those endpoints at least in repect to confidentiality. And most domains are unsigned. At least for those unsigned ones I need to just trust also in respect to integrity.
Give SJ the option to turn off DNSSEC and their website will stay broken. Give people a "someone might be tampering with your connection" popup and they would start caring.
There are also other issues with DNSSEC that need working out, but I still believe it does much more good than it does bad. Leaving everything in the background with an easy-to-disable setting makes it next to useless.
Full ACK. As a part of this, DNSsec validation needs to be as close to the client app as possible and reasonable; definitely never off-host. (Caches can do additional validation, but that makes the error reporting complicated.)
corollary: the AD bit should never be relied on on anything actually on the network. Maybe on localhost, but even there it's questionable in UX results.
> domain-validated certificates remain insecure
...99% of the internet runs on DV certificates; that's what ACME & Let's Encrypt are at the end of the day.
(You might also note I didn't actually speak in favor of DNSsec, I'm just arguing that running unbound locally without having DNSsec validation enabled isn't particularly useful. I am, generally, in favor of rolling out DNSsec, but it certainly has its problems. It doesn't help against ISP tampering on unsecured domains, for example. DoT and DoH are better against that, if [and only if] you have a trustworthy cache to point them at.)
There's a difference between what you're likely referring to, where the ISP's own DNS, which most people are using by default, returning particular results, and what the author is showing here where the ISP is actively tampering with outside DNS responses to insert incorrect responses.
Until now, I was not aware of any ISP doing the latter.
It's not universal, the occurance or this type of abuse seems to vary wildly from country to country