Hacker News Reader

Comment by teddyh | Hacker News Reader

Note: can bring down a DNSSEC-validating DNS resolver. Not any authoritative DNS server.

Most people already use a centralized resolver like Google or Cloudflare anyway, and you can be sure those will be patched. People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new?

View on HN

> People who use their ISP’s resolver might be disappointed if their ISP is slow to patch things, but what else is new?

Bear in mind that if you're using a regular port 53 resolver like Google's, you might be using your ISP's resolver anyway -- a lot of ISP's hijack port 53 and redirect it to their own server(s) to reduce load. That's why DNS over TLS / HTTPS is typically recommended over unencrypted DNS.

Do you have examples of ISPs that do this?

Worth noting that an ISP that does this --- literally intercepting all port 53 traffic, TCP and UDP --- can just strip DNSSEC, too.

In the US, Comcast does this on all business copper connections. They call it "Secure Edge". It frequently breaks DNS, VPNs, some voip, torrents (or any P2P connections), and probably other stuff. It's enabled by default on all new accounts and will randomly be at the account level.

To disable it you have to call them and ask.

In the UK most ISPs do this, it's their primary mechanism for enforcing any legal blocks against websites.

How much does that reduce load, isn't it fairly miniscule bandwidth compared with non-colocated video streaming etc.?

I think it's more about control, the reduce load argument is for plausible deniability.

I bet it'll still manage to serve ad pages instead of NXDOMAIN, though. Actually that's what will get them to patch up.

Isn't the ads-instead-of-NXDOMAIN attack the one thing DNSSEC is actually good at protecting against? So I would expect the guilty ISPs to avoid providing any form of DNSSEC support whatsoever, and thereby avoid consequences of any of DNSSEC's downsides.

No, DNSSEC does nothing about ads-instead-of-NXDOMAIN. DNSSEC is server-to-server. If you rely on your ISP's resolver server, they can ignore DNSSEC and feed you whatever they want. If you run your own validating recursing resolver, you don't have the ads-instead-of-NXDOMAIN problem in the first place.

Who relies directly on their ISP's DNS servers? Isn't the ordinary use (for residential networks, who are the targets of the attacks in question) that your router is running dnsmasq and handing out DHCP leases that instruct hosts to query that dnsmasq instance?

but that dnsmasq instance is configured by default to consult the ISP's DNS servers by default as upstream.

Right, but it has a DNSSEC option that when switched on can protect against this attack (provided the ISP isn't stripping all DNSSEC info from their replies), at the cost of suffering the other consequences of attempting DNSSEC validation. Not a great solution overall, but it does exist.

Look, you're either recursing or you're not. If you're not recursing, you're not really validating DNSSEC records. If you are, you're not vulnerable to NXDOMAIN ads. The NXDOMAIN thing is in fact not a good use case for DNSSEC. That's all I'm saying here, I'm not making any broader claim than that. Of course you can just install a recursive resolver on your router. But then you don't need DNSSEC!

> If you're not recursing, you're not really validating DNSSEC records.

Nope, validating in stubs is a thing. systemd's resolved does it. Apple's high-level network frameworks do it if you ask as of a couple of years ago (they've been back and forth on DNSSEC in their lower level API for longer than that). I'm not sure how well they work but they're there.

A validating stub resolver is effectively a recursive resolver proxying through another recursor. At the point where you're going to do that, you might as well just run a recursive server. Either way: you don't have the NXDOMAIN problem. I really don't think there's a way to get around this. It's not dispositive of DNSSEC (other things are!), it's just not a real use case?

> A validating stub resolver is effectively a recursive resolver proxying through another recursor. At the point where you're going to do that, you might as well just run a recursive server.

Every iPhone on the planet might as well be a recursive resolver? Yeah, nah.

Yeah, yah. Watch the WWDC video on how the validating stub resolver in iOS works. They even call it a recursive resolver.

RFC 8499:

   Stub resolver:  A resolver that cannot perform all resolution itself.
      Stub resolvers generally depend on a recursive resolver to
      undertake the actual resolution function.

They literally have an animation of the client resolver making repeated requests up the tree. While saying they're making multiple requests. And calling it recursive.

> ...requests up the tree

That's right, it's not recursively working its way down from the root because it's a stub resolver.

I give up. You win. DNSSEC is the perfect solution for forged NXDOMAIN responses.

Bare in mind systemd’s resolved has dnssec validation disabled by default and it’s (afaik) still marked as experimental.

Just about everyone in Australia, at least since our NBN was forcefully introduced.

(Nearly) all the wifi/routers supplied with NBN are locked to the ISP's DNS.

You can arrange to get your own wifi/router and of course you can set your own individual machine to ignore DHCP settings. But that would be rare.

Never heard of a consumer router you can't switch off as a dhcp server for the local network. Also never seen one where you can't configure the ip of the nameserver being handed out for clients to use. Which ISPs actually do this?

That said friends don't let friends do anything else than install pi-hole as the dhcp server using unbound for dns. It's never too late but do it today. I'm 100% sure this is possible in Australia.

Not a consumer router, but the cable modem / gateway provided to me by Shaw Cable (now Rogers) in Canada does not allow me to shut off DHCP or customize the DNS servers it provides DHCP clients.

I can and do put it in bridge mode and use my own router, but I was quite surprised and miffed to see this. First time I've ever come across that.

The router is a Comcast / Xfinity XB6 and I've been told that this is a "feature" of all of Comcast's routers / gateways.

Clarifying:

so you connect $something to the cable modem. Make a dhcp request and get back your public ip (and some dns servers). But it isn't doing nat or handing out local addresses to your local network. Right?

_Or_

it's a combined modem-and-router-in-one which manages your local subnet for you and you can't configure how it does this at all beyond switching the router part off and using a separate router. That sounds nuts?

I've seen this with ISP routers in France (Orange).

I'm pretty sure SFR also does this, but I don't have their router on hand anymore to test.

Free lets you configure custom DNS servers to be sent in the DHCP reply.

I'm describing the typical situation. Not the possible situation for geeks.

So not "locked" but most users don't touch the nameserver settings in their isp-supplied routers. That is quite a different thing.

It IS locked in the isp-supplied routers.

Get your own router if you want to change it. And that has various downsides.

Telstra, the only company to service my address for over 2 years post fraudband rollout, does! They sent me a stupid box I couldn't even change any of the passwords or SSIDs on as well. I was never going to use it, but my in-laws wanted to for some reason. I threw it out. The only people I know who don't use their ISP provided hardware are all techies in some way. Most of the people I know are techies, though haha

I love my pi hole and have been encouraging friends lol

It usually forwards to the ISP DNS or just configures the ISP DNS directly via DHCP.

99% of everyone who's just a consumer, I'd guess. Probably the only time people change over is when there's a DNS block on something from their ISP (work, school, commonly do that).

> Most people already use a centralized resolver like Google or Cloudflare anyway, ...

This is HN. I run unbound on a Pi (mentioning the Pi I don't know if those running PiHole are running a vulnerable resolver or not). My Pi shall need patching when I get back from vacation!

That is quite a stretch to get to that “meh”. I don’t even use 1.1.1.1 etc. and I am a HNer.

Same. I've been running my own DNS servers (caching and authoritative) since the mid 90's, back when my home network was on an ISDN line. I still use BIND.

Lots of people use 1.1.1.1 without knowing it. Firefox, for example, uses DoH by default. The default resolver for the US is Cloudflare.

https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...

Chrome followed:

https://duo.com/decipher/google-makes-dns-over-https-default...

Reply on news.ycombinator.com