EFF adds ASCII art to its DNS | Hacker News Reader

EFF adds ASCII art to its DNS

pastebin.ca

99 pointslegind29 comments

So, they don't use IP Telephony then?

You're aware you can instead of on separate lines. 9= #(a:?4 {w Tj(d w?# @(d P=W @{d : 9=w\; V: 9a# td P:d tj {w 9=W# Px @=# F=+ @(d {d #@= P= P=@: P=# WJ#sjP:WP= a?tx(a# P=@=d gawV= 9= {w : #9:w @!9_axw @{d 1d P9:wd P=W @=9=w 9{ # #:w Pn #(vj P{aW #{d !a P9nW !w# P:d #{d@:w## {d9:/4 P= P=WP=@=w/# Px{J4Pd {a P\;H1w Aw9j# :m?(J:W{d Ynwwaa*:wW## {d 9=V:d \;44#WWRav*# tj 9:d@= A?WW#W#W#w==d@(d !a A?WWUWQ#mNs4:W td As*XUW#UWNsj@:d #wv!W4W WW?=# bw?9*9!=" Though, explicitly specifying ; <<>> ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- ;; flags: qr rd ra; ;; OPT PSEUDOSECTION: ; EDNS: version: 0, ;; QUESTION SECTION: ;eff.org. ;; ANSWER SECTION: eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. eff.org. ;; Query time: 507 msec ;; SERVER: 208.67.222.222#53 ;; WHEN: Fri Mar 14 22:28:22 2014 ;; MSG SIZE rcvd: 1876 With other resolvers such Note its TCP only to prevent add whatever you want into DNS, it doesn't have to mean anything that computers understand right? you /could/ make your A records the intro to Star Wars- but nobody will be able to use your site.

TXT is a much better option imho, or.. y'know, not doing this.

Well I guess I need a new alt. dns to provision phones with.

TXT isn't an option because the records themselves are unsorted. Use the above command without the pipe to sort looks weird, but not as weird as TXT would.

MX or with numbers then?

Numbers

TXT records are actually variably-sized arrays of strings, making them very suitable for ASCII art. Unfortunately, `dig +short TXT` displays them as

    "string1" "string2" "string3" However, this is easily remedied with sed.Using TXT for artwork also has the advantage that you don't risk an intermediate resolver re-ordering things.
Source: When this came up about a month ago: https://news.ycombinator.com/item?id=7185326

I really don't think you need to use NAPTR here. Using TXT works just fine, if you do a sort, if you prepend line numbers to the records. Alas, you still have to do a sort. It would be wonderful if there was a hack that involved not using the sort. Here's one I just added: dig txt art.ten7.com |sort

Unfortunately our DNS service doesn't allow NAPTR records, so we had to go the TXT route.  Here's a large wooden object:dig +short txt log.netkine.com | sed $'s/\" \"/\\\n/g'

I get this. I can't make out what it's supposed to be.
                         P!**9N# !nPx   A>4 wawa\;? P9na\;=# WSgmN W4Wmm W4Dm mW pre>

a log...

it's big, it's heavy, it's wood

Which clients use NAPTR? Can't you have a SRV record without NAPTR?

>So, they don't use IP Telephony then?A lot of VoIP deployments simply ignore the whole DNS side of things, or at best use an A record. Especially in wholesale, it's IP only (using domains breaks some things), and authentication is based on IP, too. (Source IP on a UDP packet - very secure.)

Interestingly, with OpenDNS, this does not show up using the any query:
    $ dig @208.67.222.222 any eff.org DiG 9.9.2-P2 <<>> @208.67.222.222 any eff.org opcode: QUERY, status: NOERROR, id: 61530 QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1 flags:; udp: 4096 IN      ANY 3756    IN      A       69.50.225.155 6413    IN      NS      ns6.eff.org. 6413    IN      NS      ns2.eff.org. 6413    IN      NS      ns1.eff.org. 507     IN      SOA     ns1.eff.org. hostmaster.eff.org. 2014031300 3600 1800 604800 1800 (208.67.222.222) the NAPTR type does display it:
    $ dig @208.67.222.222 -t naptr eff.org DiG 9.9.2-P2 <<>> @208.67.222.222 -t naptr eff.org opcode: QUERY, status: NOERROR, id: 65029 QUERY: 1, ANSWER: 23, AUTHORITY: 0, ADDITIONAL: 1 flags:; udp: 4096 IN      NAPTR 6304    IN      NAPTR   300 10 "" "                 !!!!!!!!!!!!!!!!!!!!!!!!!!                 " "" . 6304    IN      NAPTR   310 10 "" "                     !!!!!!!!!!!!!!!!!!                     " "" . 6304    IN      NAPTR   320 10 "" "                         !!!!!!!!!!!                        " "" . 6304    IN      NAPTR   100 10 "" "                          !!!!!!!!!                         " "" . 6304    IN      NAPTR   110 10 "" "                      !!!!!!!!!!!!!!!!!!                    " "" . 6304    IN      NAPTR   120 10 "" "                   !!!!!!!!!!!!!!!!!!!!!!!!                 " "" . 6304    IN      NAPTR   130 10 "" "                !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!              " "" . 6304    IN      NAPTR   140 10 "" "              !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!            " "" . 6304    IN      NAPTR   150 10 "" "            !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!          " "" . 6304    IN      NAPTR   160 10 "" "     @@@@@@@@@@@@@@@@@@!!!!!!!!!     !!!!!!!!!!!!!!         " "" . 6304    IN      NAPTR   170 10 "" "     @@@@@@@@@@@@@@@@@@!!!!!!!!!  !!!!!!!!!!!!!!!!!!        " "" . 6304    IN      NAPTR   180 10 "" "     @@@@@@@!!!!!!!!!!!!!!!!!!!!    !!!!!!!!!!!!!!!!        " "" . 6304    IN      NAPTR   190 10 "" "     @@@@@@@!!!!!!!!!!!!!!!!!!!!  !!!!!!!!!!!!!!!!!!!       " "" . 6304    IN      NAPTR   200 10 "" "     @@@@@@@!!!!!!!!!!!!!!!!!!!!  !!!!!!!!!!!!!!!!!!!       " "" . 6304    IN      NAPTR   210 10 "" "     @@@@@@@@@@@@@@@@@@!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!       " "" . 6304    IN      NAPTR   220 10 "" "     @@@@@@@@@@@@@@@@@@!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!       " "" . 6304    IN      NAPTR   230 10 "" "     @@@@@@@!!!!!!!!!!!!!!!!!!!!     !!!!!!!!!!!!!!!!       " "" . 6304    IN      NAPTR   240 10 "" "     @@@@@@@!!!!!!!!!!!!!!!!!!!!  !!!!!!!!!!!!!!!!!!        " "" . 6304    IN      NAPTR   250 10 "" "     @@@@@@@!!!!!!!!!!!!!!!!!!!!    !!!!!!!!!!!!!!!         " "" . 6304    IN      NAPTR   260 10 "" "     @@@@@@@@@@@@@@@@@@!!!!!!!!!  !!!!!!!!!!!!!!!!          " "" . 6304    IN      NAPTR   270 10 "" "     @@@@@@@@@@@@@@@@@@!!!!!!!!!  !!!!!!!!!!!!!!!           " "" . 6304    IN      NAPTR   280 10 "" "            !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!            " "" . 6304    IN      NAPTR   290 10 "" "              !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!              " "" . (208.67.222.222) as Google public dns, or DNS Advantage, it does show up with the any type. Can anyone explain, why it doesn't show up with OpenDNS using the any type?

Not the only ones:
  dig ch whois.cloudflare @lee.ns.cloudflare.com abuse. Also overloading the Chaos protocol to avoid messing with real DNS.

My first thought on seeing that is it would be great for a DNS amplification attack. Not sure the value as an advertisement though...

I think it's too big for UDP, it'll renegotiate TCP for anything over a certain size.thus DNS amplification is impossible because spoofing the TCP source would fail a handshake.

The size is 1876 bytes, DNS servers which support EDNS will do up to 4096 byte replies in UDP.

agreed, this is a bad idea and is likely to be abused shortly

What happens if someone chops up binary data such as a copyright movie file BASE64 encoded into DNS text records? Does all the DNS operators with that in the cache become illegal file sharers then?

Not binary data but: http://decss.zoy.org/Loot at entry 9, they use a similar hack to distribute the DeCSS (DVD DRM decryption program) source code through DNS.
> Mark Baker noticed that you could do the request to any nameserver. Which means for instance that the DeCSS source code is available from the DVDCCA's nameservers !

Here's the whole thing unsorted: http://pastebin.com/z7BzEnhCand in case you want to learn about NAPTR: http://www.ietf.org/rfc/rfc2915.txt

Regular expressions in DNS records? That sounds like it would be an easy possibility of exponential resource consumption: http://en.wikipedia.org/wiki/ReDoSAfter a quick Google, it turns out some versions of ISC BIND were vulnerable to this... but I'm almost willing to bet a lot of other software that handles NAPTR could be as well.

Hopefully they use re2[1] or a similar regexp engine without backtracking.[1]: https://code.google.com/p/re2/

Would love a how to....

http://www.cambus.net/storing-ascii-art-in-the-dns/

That's brilliant! (reminds me; wasn't there a blog that was published in HTTP headers once?)

http://www.nextthing.org/archives/2005/08/07/fun-with-http-h...

looks like someone had a little too much time on their hands...great work though

Reply on news.ycombinator.com