Hacker News Reader

Comment by Waterluvian | Hacker News Reader

I set up a pihole and literally forgot about it. Like I was cleaning out a closet on moving day and found it plugged in. Took a moment to even realise what it was doing there.

View on HN

Finding a years abandoned Linux server on your home network m ight be a good leasson to always treat your home network as if it was compromised.

Honestly curious: how would you exploit it? If the pi isn't exposed to the www by your router, what can you do?

The PiHole interacts with DNS servers. Theoretically - imagine a crafted TXT Record which is somehow improperly handled by dnsmasq.

Essentially - it's reading user-defined data - which is probably enough to be really bad, incase of a malicious exploit in the wild.

Typically a pi-hole is used as a DNS resolver. In order to work it must connect to the internet.

Scenario for attack: Laptop looks up a website, DNS request is made to pi-hole, pi-hole sends request to internet. Response packet received back is actually from an attacker, that uses a known vulnerability in the handling of the packet to take over the machine.

Attacker can now see what DNS requests are being made, and by returning custom responses, it can MITM any HTTP request you make from your laptop. Let's hope everything is encripted via TLS, and hope that some piece of software that just asked for admin permission didn't just install a new TLS trust root.

That is definitely a bad situation. Thanks for the reply. Unnerving to think there'd be even a possibility of getting root just from processing a DNS response!

There are lots of ways. A basic vector is CSRF (like eg https://tools.cisco.com/security/center/content/CiscoSecurit...), or the server side variant (SSRF). Then there's the DNS vector already mentioned. There are others too. Generally it's a bad idea to rely on home network boundary protections.

I’m reminded almost every day that I have a pi-hole since it is not my dns provider when on my company’s vpn. It’s absolutely night and day on so much of the web. Some sites have so many ads now it’s just shocking to be frank.

Why not use a client based content filter such as uBlock Origin?

Not them, but you can’t do that at every company.

Also maybe they use their phone and many combinations of PhoneType + BrowserType don't support the same quality of adblocking as PiHole.

Mobile Firefox Supports ublock Origin nowadays.

I'd encourage anyone to try that out

On iOS too?

No, but there are plenty of other content filtering solutions on iOS, including Mozilla’s own Firefox Focus that can be installed as a system-level content filter.

NextDNS is pretty good especially on iOS where you can’t install adblockers (unlike on rooted android)

You can't?

https://www.imore.com/how-block-ads-your-iphone-or-ipad

> Where can I block ads? Only in Safari (or an app using the Safari View Controller).

Pihole is a system wide Adblocker and so is NextDNS on iOS. So are the ones you can install on Android rooted.

latest ios 13, AdGuard Pro installs VPN profile and filters on DNS level pretty well.

Relevant adventure with iOS update rejection: https://adguard.com/en/blog/adguard-pro-is-back.html

I could (and heck, probably should). But I don't browse websites all that often on the vpn. Just on the occasion that I do, I'm blown away at all the ads :) So just lazy.

Obviously will depend on your company, but some corporate VPN clients will still let you use a local or alternate DNS. Then just add the machines you need to connect to on your work network to your hosts file.

Won't fix your issue but I run a Wireguard VPN on my PiHole that allows me to get onto my local network. The other upside is that once connected you get the PiHole blocking from anywhere....

Reply on news.ycombinator.com