Hacker News Reader

Comment by sp332 | Hacker News Reader

It didn't shut off all internet access. The DNS resolver on the router checked for connectivity. If it couldn't resolve Belkin's domain, it disabled the DNS service because it assumed the Internet wasn't really connected.

Edit: see the workaround here https://belkininternationalinc.statuspage.io/

View on HN

OK, this is much less scary than I thought reading the article. Probably wouldn't hurt to diversify it a bit and use some major provider like Google or Amazon (or both?) for the check, but at least it doesn't look as bad as the vague description in the article that made me think some vital router functions and not simple DNS check depend on external infrastructure.

For most people, DNS on the router is vital because they don't know how to get online without it.

It shouldn't be less scary. Any time proprietary software calls home it could receive orders to open a backdoor or anything else. It's a command and control feature disguised as a DNS check, or at the very least it could be easily turned into one at any point without raising suspicion.

I think you're being too paranoid here (I don't say this often :). A ping to known good host is a benign thing. Can it be replaced with malicious thing? I'm sure it can, somebody could gain access to your router and reflash it with malware and you wouldn't even know. This is a real possibility. But it remains so regardless of presence or absence of DNS ping, so DNS ping by itself does not add any specific threat.

Calling it a "DNS ping" is just confusing or wrong. It's a DNS query.

It's dangerous because:

1. It allows them to create a database with the IP address of every internet-connected router.

2. It allows them to control routers via DNS packets, which are frequently permitted even behind firewalls.

3. It providers a cover for traffic to their servers on the DNS port.

This kind of thing is very common. It's also very dangerous and we should demand alternatives.

I called it DNS ping because it essentially serves the same function as "ping" command but on slightly different level - by checking if DNS functions.

1. This is true, but most routers check for firmware updates anyway, so there you go. Not to mention online warranty registrations, etc. which would get you into their DB anyway.

2. Unlikely, unless you have a RCE bug in your DNS implementation, in which case the router is toast without the DNS querying.

3. One query is not "traffic". It is pretty easy to distinguish between one query on boot and constant communication. Again, it is only relevant if you already have malware in your router.

#1 and #3 are not even refutations and #2 you didn't even understand. You're absolutely wrong that this isn't a security issue. The simple proof is that no secure network would ever allow a device to call home like this.

Maybe you think that because it's common it's not a problem. That's not how security works.

Amazon/Google might be a little annoyed if every Belkin router on the planet started pinging them.

They would love it. Why do you think they provide public DNS in the first place?

Google provide public DNS because they think they can make people's DNS faster and more reliable, which causes web pages to load faster and more reliably, causing Internet users to be happier when using the Internet, and therefore providing more analytics data and ad revenue to Google.

and, they know where people are looking/surfing/...

They probably get much more legit traffic than that. Router doesn't need to do it that frequently, only when it needs to find out if internet connection is alive. Which is usually on boot and maybe on infrequent occasions after that. So they wouldn't even notice.

No. Terrible idea: http://pages.cs.wisc.edu/~plonka/netgear-sntp/

>some vital router functions and not simple DNS check

How do you expect 99.99% of the world to get to facebook.com without DNS? It's pretty damn vital if you ask me, especially for a consumer grade router.

But their DNS doesn't actually depend on that server (at least according to the explanation above). Only the part of the code checking "do we have internet?" depends on it, and only because they use some internal company's address and apparently whoever is responsible for it doesn't know that if this host ever gets down it breaks the internet for all Belkin customers. So it's a simple case of miscommunication and failure to think systemically, not something fundamentally broken.

Do a dig of heartbeat.belkin.com and you get a bunch of 54.0.0.0/8 addresses that Amazon bought from Merck. It's using AWS.

Looks good, but how comes then it still didn't work properly? I see only two possibilities: somebody managed to mess up all the redundant servers at once, by either messing up firewall rules or replicated config or something like that, or somebody messed up heartbeat.belkin.com. DNS entry.

Looks like I was wrong cause I checked too late, Belkin moved to AWS as part of the fix, doh!

https://news.ycombinator.com/item?id=8429789

Running your own servers for Internet checks is what you're supposed to do -- when you don't, you cause problems for other people (e.g. if Google decided to sell an address block or change its DNS name or if someone decides to deprecate an NTP pool server).

For example, look at the document made by the NTP Pool: http://www.pool.ntp.org/en/vendors.html. Microsoft has time.windows.com, Apple has time.apple.com, and Canonical has ntp.ubuntu.com.

I recall reading a story where someone checked network connectivity by pinging a DNS name with a known but invalid IP address, and relying on the exact error message. When a sysadmin later removed the "invalid" DNS entry, ping would return a different error message, which caused the network connectivity check to fail. People do strange things for connectivity checks -- what Belkin did here seems pretty "by-the-book" by comparison.

This is why when I want to implement a negative connectivity check I always make a deal with admins to have a will-never-exist.whatever.com or similar record with known and documented behaviour.

Yes, that's because I've been caught out before :)

Hanlon's Razor seems to fit this debacle fairly well:

"Never attribute to malice that which is adequately explained by stupidity."

Humans are rarely stupid, unfortunately.

Better to remain 'agnostic'

Rarely?

Can I live in your reality? <3

There are two kinds of people in the world:

(1) Those who say 'this is stupid'; and

(2) Those who say "oh, i get it"

Rarely do they coincide empirically.

In any reality, humans are ingenious at things you don't want them to do.

Reply on news.ycombinator.com