Hacker News Reader

Comment by ciarannolan | Hacker News Reader

>I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing.

Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.

View on HN

Some ad agencies starting asking hosters to add a CNAME record to one of their domains.

Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com.

As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money!

So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`.

When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more.

What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

This CNAME method is also a huge security issue, but I'm not gonna go into that.

> This CNAME method is also a huge security issue, but I'm not gonna go into that.

A security issue for the website with the CNAME, or a security risk for Pi-hole implementing this feature?

For the website - https://news.ycombinator.com/item?id=23137309

> This CNAME method is also a huge security issue, but I'm not gonna go into that.

I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.

How does this work exactly? asking for a friend.. (like the requests from browser to definitely-not-an-ad-subdomain.dastx.me also include cookies set by *.dastx.me content?)

Yep. Cookies frequently pass from parent domain (edoceo.com) to child (ads.edoceo.com)

That's how Microsoft Teams accidentally gave away their customers' credentials to hackers, right?

Yep, that combined with an orphaned DNS record

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Right

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Yeah, uBlock Origin recently added a new permission request just to allow that.

From my understanding, it only works in Firefox and not Chrome though as an FYI.

Correct. Chrome doesn't have such mechanism and if I'm not mistaken, they've already shot down the idea of adding this API.

cdn.goodsite.com -> tracker.badsite.com

cdn used to mean - serve the same static content all over the world and speed things up.

cdn now means - serve up different content to every single person and track them.

take a look at stack overflow and it's cdn.

Just because bad guys use a CDN doesn't mean CDNs are bad

Thanks! I hadn't heard of this method. One question though: What will prevent the ad providers from asking their customers to add an A/AAAA record to one of their IPs? That'll be much harder to combat for an adblocker especially because those IPs will usually be shared with actual content services.

Of course this'll add overhead to the visited website manager because the IPs will probably change regularly as they're pointing to cloud services. But I'm sure they'll manage to automate this.

I bet this will be the next step in this cat & mouse game.

I think it would be only marginally harder to combat, since now you just need a list of IPs to block. Someone would have to maintain the (likely ever changing) list of IPs used, but that's not so different from what's happening now.

> Someone would have to maintain the (likely ever changing) list of IPs used

What if the ad-network is domain-fronting via a CDN? Either ways, can't block IPs since http-domain <-> IP isn't supposed to be a one-to-one mapping, each belong to different layers of the TCP/IP stak.

Here's an example from the feature request:

Here is an example (the domains are fake, it’s for demonstration purpose only): The domain adcompany.com 5 is in my blacklist, so it returns the IP of my Pi-Hole if I do a DNS query:

$ host adcompany.com adcompany.com has address 192.168.1.10

But if I do a DNS query of ad.newspaper.com it doesn’t get blocked by Pi-Hole even though it’s simply an alias (CNAME) for adcompany.com:

$ host ad.newspaper.com ad.newspaper.com is an alias for adcompany.com. adcompany.com has address 6.6.6.6

What I would like that Pi-hole do is to check if the domain is a CNAME (in the example ad.newspaper.com) then comparing the domain that is aliased to (in the example adcompany.com) with my blacklist. If it is in my blacklist block the domain (by returning the IP of my Pi-hole).

Source: https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cn...

One of a trick a website operator can use to evade hostname-based adblockers is by putting the ad-serving domain as a cname entry in one of their subdomain. Since the ad now served from a subdomain of their website, it won't get blocked unless the dns adblocker did deep inspection on nested cname entries.

Reply on news.ycombinator.com