Hacker News Reader

Comment by stephengillie | Hacker News Reader

A way to protect yourself is to manually specify DNS servers - to your own, or a trusted public one like 4.4.2.2 or 8.8.8.8. It's buried in the network settings, but DNS servers can be specified even if you're getting your IP from DHCP.

This attack only works if you're getting DNS info from a malicious/compromised source. So if you're on a coffee shop WiFi, it creates another layer of complexity - the attacker would have to rewrite/spoof the DNS packets instead of simply serving the malformed packets directly.

View on HN

Would that make a difference if you're getting MITM?

The coffee shop WiFi would have to rewrite the packets with a new payload. Not too difficult, but a different skillset and scope than the original attack.

No, unless you configure your IP address statically and use a VPN that doesn't require a DNS lookup to connect so basically, it's hard to avoid these issues on a rouge network.

A lot of WiFi hotspot gear has built-in functionality to intercept/redirect DNS traffic. Or, as they are routers already, the ability to do it with firewall rules and such.

We've talked about the risks of these kinds of MitM attacks for years. The good news is, the large players have vested interest to keep their networks secure.

>A lot of WiFi hotspot gear

sure, and they all run vulnerable Dnsmasq, win win.

And why you think that someone can make free WiFi hotspot and can't route that both IPs to it's own DNS server?

By default, probably 99.99% of devices will use the WiFi DNS. The attackers may not want to go through the difficulty of changing routes to handle that .01% exception. That 99.99% might be good enough for them.

Isn't that 4.4.4.4 or does Google also have a public DNS server on 4.4.2.2?

4.4.2.2 is Level3, now owned by CenturyLink.

Google Public DNS IPs are 8.8.8.8 and 8.8.4.4.

Source: https://developers.google.com/speed/public-dns/

Reply on news.ycombinator.com