Tellingly, the article almost completely ignores the apparently sizable number of US ISPs that return something very different from NXDOMAIN ("not found") when you ask for a nonexistent domain name.
A working DNS server is a good thing.
A working DNS server is a good thing.
I was surprised by this rather recently, when my girlfriend and I moved in with her brother to conserve finances (both his and ours, since their other brother had just moved out leaving him with larger-than-payable bills). I mistyped a URL and it came back with an ISP-provided search page, which infuriated/surprised me. As it turns out, I only had the wireless connection set to use GDNS, but I was temporarily using a wired connection until I could buy a new wireless router (the previous one was a modem/router combo from the ISP, despite the fact that when I returned it the woman at the desk "corrected" me when I told her I was returning the router, saying that they don't deal with routers. I just smiled, did my business, and left.)
75.75.75.75 and 75.75.76.76
It's frightfully annoying (but easily disabled for the technically-aware), because it actually redirects - this means fixing newss.ycombinator.com requires retyping the URL in its entirety.
I prefer to use OpenDNS. They do show a search page, or a "not responding" page, but they don't bug or track me that I'm aware of.
The statement of "DNS server in question not passing the query directly to the search engine but through a host of other URLs" is factually nonsense - DNS server only is supposed to pass the query (that being a query for an A/AAAA records in the browser case, not the search query as they imply) to the authoritative servers within the hierarchy.
I think what this article means is as follows:
- the browsers try the name lookup on the DNS before treating the contents in the address bar as a search query.
- this treatment happens if the DNS replies NXDOMAIN
- if the domain exists (the browser gets A/AAAA record), the browser contacts the server in the reply.
- so the malicious DNS servers take the queries for which they are supposed to return the NXDOMAIN and instead interpret them and return the A/AAAA answers pointing to the servers filled with ads related to the keyword which was present in the DNS query.
- this is bad.
Of course this kind of "setup" breaks other applications besides the web - but, HTTP being north of 90% traffic volume, no-one cares too much, probably.