Hacker News Reader

Comment by goguy | Hacker News Reader

Here in the UK sky recently pushed out an update to their firmware which made it impossible to use another DNS server other than theirs. There was a decent amount of push back, I managed to get them to downgrade my firmware but who knows how long that will last before they "accidently" update it again.

View on HN

I use Sky. I wasn't aware of this. :(

I also use my own router so I assume it doesn't affect me or does this mean that their network doesn't allow other DNS servers?

How would that affect a VPN? I use PIA and they have their own DNS servers.

I'll need to experiment with this when I get home I think.

> How would that affect a VPN?

If your DNS requests are going over the VPN then you will be fine as they will be in the encrypted tunnel before they travel through your router so it can't do anything about them. A change to the router firmware won't be able to override DNS server settings on other individual hosts.

If your router is providing the local VPN endpoint then that is another matter, but IIRC PIA runs on your local station. Do check that it is in fact setting your machine to send DNS requests over the link. I'd be surprised if it wasn't, but you never know.

Don't you run an own router/firewall behind the ISPs? I own my internet facing router AND I run a second one for sensitive parts of my network. As well, I run an own recursive resolver.

What's the best way to tell if they're intercepting queries to other dns servers and replying themselves?

Say I manually set my dns to 1.1.1.1, is there a way to tell if the replies are really from 1.1.1.1?

An NSLOOKUP will tell you the DNS server that your query went to.

ISPs can man-in-the-middle spoof that too, right?

Even if you intercept and nat traffic going to UDP/53?

Unfortunately that will not help: if the requests to other servers are NATed when they hit the router it will look like your request went elsewhere when in fact to went to Sky. nslookup is reporting what it tried to connect to for an answer, not what actually answered.

If it is not "encrypted" (with some form of end-to-end encryption, like HTTPS or SSH), you dont.

> What's the best way to tell if they're intercepting queries

Setup a simple DNS resolver in an external VM (use a service like DO where you can pay by the hour, and the test will cost you at most tens of pennies), configure it with a DNS zone that the rest of the Internet does not know about (thisdoesnotreallyexist.net). Then if you try query for that domain from that server but get an NXDOMAIN response your query was probably intercepted (of course test from other locations too, to make sure the problem isn't a mistake in the new resolver's config).

Or you could configure the test resolver to give different answers for an existing domain, of course, and check for which addresses you get back instead of checking for address or error - that would essentially be the same test.

Or, he says, thinking of the obvious after explaining the more long winded, if you have a DNS server in your control, simply turn on the relevant logging options and run a query against it and see if your query turns up in its logs.

This assumes they are intercepting and NATing all standard DNS requests (usually on UDP & TCP port 53), rather then just DNS traffic going to a list of known alternative DNS services. If they are doing the latter then there are tests you can do that rely on timing and TTL settings (get their server to cache a result, change the name->address mapping, then ask 8.8.8.8 or similar and see what answer you get).

With no changes to your setup it is actually impossible. DNS as it currently exist is a plain text protocol.

If you run your own dns server at your local machine you can enable DNSSEC, which will protect against manipulations for domains that has that enabled. A recursive dns server is pretty easy to setup and it a step towards running your own authoritative server in the future for private domains.

If you want to resolve using googles DNS servers and be sure it is really them then the only method that I know that is also supported by google would be DoH. The other encryption method they support, DoT, do not provide authentication and draft-bortzmeyer-dprive-resolver-to-auth-00 is to my knowledge not implemented by google.

If you want a bit more privacy and have a mix of the two above then go with a VPN or build one yourself. Just note that without DoH you won't be authenticating between the VPN and google, so I would just use a resolver at the VPN.

If you run your own DNS server at your local machine, you'll be exposing all your queries to your ISP, which will log and monetize them. You'll gain support for a DNSSEC protocol that virtually nobody on the Internet uses --- DNSSEC only functions on signed zones, and in 25 years almost nobody has signed a zone --- and so your ISP will almost always be able to manipulate your queries anyways.

If you use google servers under plain text you will be exposing all your queries to your ISP and to google, which will log and monetize them. DNS under plain text is so easily captured that all entities. ISP that spans the traffic to google, google itself, and ISP that spans from google to the resolver can capture, log and monetize the information. Monetizing can occur by logging who queried, what was queried, and in either as a combination or in isolation. A lot of companies consider the later to not be private information or covered by GDPR.

The effectiveness of DNSSEC depend on where you are. If you live in Netherlands or Sweden and visits mostly Swedish or Dutch sites then a larger portion will be signed.

of course: dnsleaktest.com

I noticed they were doing this when I saw that in-band DNS updates were failing. Eventually I realied that my router (or something upstream of it) was returning an error to the client rather than passing through the GSS-TSIG-signed nsupdate packet.

So far I have been unsuccessful in my attempts to get through to a technician who knows anything other than "try turning it on and off again". I suspect this policy is deliberate.

> which made it impossible to use another DNS server other than theirs

'cause DNS logs & users data brings them good money, so they just defends business.

BT's DSL router/modems also only hand out BT DNS servers. You have to turn off their DHCP server and run your own to be able to hand out anything else.

Their tech support (the one that's "if we solve the problem we'll charge you") said they could not solve this for me.

Interesting. Time to switch ISP then.

Reply on news.ycombinator.com