An anonymous reader writes
"An interesting (and profane) writeup of one frustrated user's discovery that Comcast is actually intercepting DNS requests bound for non-Comcast DNS servers and redirecting them to their own servers. I had obviously heard of the DNS hijacking for nonexistent domains, but I had no idea they'd actually prevent people from directly contacting their own DNS servers." If true, this is a pretty serious escalation in the Net Neutrality wars. Someone using Comcast, please replicate the simple experiment spelled out in the article and confirm or deny the truth of it. Also, it would be useful if someone using Comcast ran the
ICSI Netalyzr and posted the resulting permalink in the comments.
Not happening to me (Score:5, Informative)
I'm a Comcast user, and I run a DNS server for a few private domains that only I use. I have not experienced this, and I just verified that it's not currently happening. I'm in California if that matters.
Re:Not happening to me (Score:5, Interesting)
I'm a Comcast user, and I run a DNS server for a few private domains that only I use
Are you running that and hoping that your dynamic IP address doesn't change or do you have a business account with a fixed IP? If it's a business account than I would assume that they aren't redirecting those but could still be redirecting on consumer accounts.
Parent
Re:Not happening to me (Score:5, Interesting)
Funny,
Here are the results from a static IP:
--Knoxville.hfc.comcastbusiness.net --
--UDP access to remote DNS servers (port 53) appears to pass through a firewall or proxy.
The applet was unable to transmit an arbitrary request on this UDP port, but was able to transmit a legitimate DNS request, suggesting that a proxy or firewall intercepted and blocked the deliberately invalid request.
The applet was unable to directly request a large DNS response. This suggests that a proxy or firewall is unable to handle large extended DNS requests or fragmented UDP traffic.--
There might be some other issues here:
http://www.auditmypc.com/port/udp-port-53.asp [auditmypc.com]
Parent
Re:Not happening to me (Score:5, Informative)
Comcast is using nearly off the shelf DHCP with really long expires times. When you get an IP, you'll have it for months, and usually don't loose it until those months have passed AND you reboot your equipment and get a new IP.
DSL on the other hand is using PPPoE (PPP over ethernet.) Every time it starts a new session it gets a new IP, completely independant of what it had before. And from my experience with ATT/Bellsouth it's not daily, it's hourly. Unlike a direct link, PPPoE must renegotiate every time there's a momentary signal loss, just like dialup would do.
From what I've read, they use PPPoE because it's the easiest way to enable/disable users in real time via a RADIUS server. Comcast has to use more complicated methods to kill accounts (in some places, even send out a truck to put on a filter)
Parent
Re:Not happening to me (Score:4, Informative)
Me too. I'm also in CA and it is not curently happening.
Parent
Re:Not happening to me (Score:5, Interesting)
Parent
Re:Not happening to me (Score:4, Informative)
Parent
Re:Not happening to me (Score:5, Insightful)
Isn't that the point of this outrage?
More like intercepting traffic that isn't destined for Comcast as if it were. You're not attempting to contact Comcast in any way, but that's where the traffic is ending up.
Let's say Comcast, for some reason, suddenly decides that your site should no longer be reachable (by name), they could start intercepting DNS requests for your site and returning domain not found. Or worse, redirecting you to a site they find more "suitable."
Parent
Re:Not happening to me (Score:5, Funny)
Or, more simply, query something you know doesn't exist (like asdfdsafdsafhdsds.com) against your server
Thanks alot. Now I'm going to get slashdotted.
Parent
Re:Not happening to me (Score:4, Funny)
> Or, more simply, query something you know doesn't exist (like asdfdsafdsafhdsds.com)
1) Quickly registered non-existing domain mentioned on Slashdot and put up an ad-serving site.
2) Wait for bored Slashdotters to try the link.
3) Profit.
Thanks Slashdot :-)
Parent
Re:Not happening to me (Score:5, Insightful)
Isn't that the point of this outrage? Getting typojacked when you try to go to a genuinely invalid URL?
Actually, no. We've been outraged about that before. It's one thing if I use someone's server and it typojacks me due to a wildcard entry in the name tables. The alleged behavior we're discussing actually prevents* the user from using another nameserver outside of that ISP in order to sidestep the problem.
* (well, makes more difficult, requiring tunneling or something like that)
For quite awhile I've had the feeling that DNS will eventually be brokered through P2P/DHTs/etc with digitally signed payloads, and this type of behavior only makes that idea more appropriate.
Parent
Re:Not happening to me (Score:5, Informative)
I'm certain. I sent a query to a DNS server that I control. I ran tcpdump on the DNS server and I could see the packets from my home IP address coming in with the query and the refusal going out (I asked the DNS server that I control to resolve yahoo.com, which it should refuse to do).
Parent
Re:Not happening to me (Score:5, Insightful)
Parent
Re:Not happening to me (Score:5, Informative)
The machine from which I sent the request is connected to a Comcast residential Cable Internet connection. The server at the other end is a virtual machine in a colo facility somewhere -- not a Comcast facility. And before anyone asks, I tried both tcp and udp requests with the same result (no interception, no transparent proxy).
Parent
Re:Not happening to me (Score:4, Interesting)
Except that he actually received and sent the packets on the server and verified as such.
Parent
Re:Not happening to me (Score:5, Funny)
Then that's even worse! It means Comcast must have hacked his server to falsify the logs! /s
Parent
Re:Not happening to me (Score:5, Informative)
They are blocking port 53 it appears here in Virginia.
--UDP access to remote DNS servers (port 53) appears to pass through a firewall or proxy.
The applet was unable to transmit an arbitrary request on this UDP port, but was able to transmit a legitimate DNS request, suggesting that a proxy or firewall intercepted and blocked the deliberately invalid request.
The applet was unable to directly request a large DNS response. This suggests that a proxy or firewall is unable to handle large extended DNS requests or fragmented UDP traffic.--
I don't know about them hijacking it though. I'm not sure what causing it yet.
Look this way for more info:
|
|
|
\
\
V
Parent
Re:Not happening to me (Score:4, Insightful)
This is retarded.
I point my router's DNS to OpenDNS.org and everything works great. If I type a BS domain I get the OpenDNS search page.
One idiot's Wordpress blog is enough to make it to the front page? I mean, I think Comcast is the devil incarnate, but there are plenty of legitimate reasons to hate them without making up BS stories.
Parent
Fuck `Em All (Score:5, Funny)
When Comcast took over from Time Warner here, I bailed.
I mean, Time Warner is evil. AT&T (who I switched to), is evil.
But Comcast is Motherfucking Sith Lord EVIL.
Scary fucking eeeeevil. Nazi evil. RIAA evil.
Re:Fuck `Em All (Score:5, Funny)
So what are you trying to say?
C'mon man, stop beating around the bush and get to your point.
Parent
Re:Fuck `Em All (Score:5, Funny)
C'mon man, stop beating around the bush and get to your point.
It had something to do with star wars. The sith lord part tipped me off.
Parent
Re:Fuck `Em All (Score:5, Informative)
group sex with Oprah Winfrey, Rosie O'Donnell, Roseanne Barr and Chelsea Clinton
That's the absolute worst thing I've read in a long time.
Well done, sir.
Parent
Re:Fuck `Em All (Score:4, Insightful)
Parent
Re:Fuck `Em All (Score:5, Funny)
Parent
Re:Fuck `Em All (Score:5, Funny)
Parent
That's a negative (Score:5, Funny)
Comcast results in Houston, TX (Score:4, Informative)
Here are the ICSI results [berkeley.edu]. Results are from a PC behind a bog-standard Linksys WRT-54g, for what it's worth.
Not my field, but I see Direct TCP access to remote DNS servers (port 53) is allowed. I'll leave it to the networking experts to pick through the rest of the report.
errmm... (Score:3, Informative)
TCP is generally only used for excessively large requests or zone transfers
Tm
Netalyzer results (Score:3, Interesting)
http://netalyzr.icsi.berkeley.edu/restore/id=ae8199f5-18807-f5eeee66-ce59-42a4-8803 [berkeley.edu]
Note that my DNS servers are Level3 servers (4.2.2.2, 4.2.2.4) since they are much faster than Comcast DNS.
Damn! That may stop my plan...... (Score:4, Funny)
Re:Damn! That may stop my plan...... (Score:4, Interesting)
Have you heard of IP over DNS? The DNStunnel software sends IP packets as TXT records over a real DNS, the client sends data in the request itself. Since these are real resolvable DNS records, proxying port 53 won't work. When I tried this software, I could only get a single stream over the tunnel, so I ran SSH over the DNStunnel and used ssh to forward a TCP port that I then ran OpenVPN on. This actually works, but it is very slow. And I can imagine that people would eventually find out because the wifi provider's DNS cache will fill up with IP data.
Parent
Is this happening for ANYONE? (Score:5, Insightful)
Official Response (Score:4, Informative)
"Official Response" (Score:5, Insightful)
Parent
Re:"Official Response" (Score:5, Informative)
I'd watch what you call an 'Official Response' as many corporations have very strict rules about talking to the press, or making any binding claims to a general audience. Are you authorized for such communication?
Yes she is. She's handled one of my responses before. Recently corporations have started hiring "social networking" types to answer questions on places like twitter, facebook et al. It would Slashdot is another one of these venues.
Parent
Re:"Official Response" (Score:4, Funny)
Parent
Re:Official Response (Score:5, Insightful)
Parent
As one of the authors of Netalyzr... (Score:5, Interesting)
We have not seen any redirection issues with Comcast user's DNS settings.
Questions on netalyzr itself will be answered in this thread.
Re:As one of the authors of Netalyzr... (Score:5, Informative)
A colleague who knew about our launch told us we just got slashdotted.
We actually WANT to get slashdotted, because that helps us measure the network.
Parent
So let me see if I have this straight... (Score:5, Informative)
News for nerds, indeed.
Re:So let me see if I have this straight... (Score:5, Insightful)
Welcome to the new Media Democracy.
Parent
Test market? (Score:4, Interesting)
I don't see anyone else mentioning this, but it seems they could be using a particular area to test this "policy"
Re:Not happening here (Score:4, Interesting)
I suppose users could tunnel DNS over some other port if they had to.
I route all of my DNS requests through a VPN to the DNS server at my office. Not everybody has this luxury though. I wonder if OpenDNS would be inclined to set up a VPN solution for people stuck with an ISP as arrogant as Comcast?
Parent
Re:Not happening here (Score:5, Interesting)
I'm wondering how this post ever made it to the slashdot front page. I haven't RTFM, but as it's from the domain comcastfuckingwithyourport53traffic.wordpress.com I don't see any reason to lend it credence.
The comments to this story say a lot, almost as much as the domain the story links to. Somebody screwed up posting this.
Parent
Re:Using OpenDNS on Comcast (Score:5, Informative)
Likewise in Southern New Jersey (and Philadelphia before this -- the very heart of Comcast darkness)
I get OpenDNS error pages for nonexistent domains.
Parent
Re:DNSSEC? (Score:5, Informative)
DNSSEC is validated at the resolver level. However, even if you run your own local DNS resolver, DNSSEC wouldn't come into play -- Comcast can simply strip the KEY/RRSIG records entirely before sending them to you -- leaving your resolver thinking that the zone has no DNSSEC records at all (at which point, they are blindly accepted as valid).
I'd imagine that there is an option somewhere in bind to only accept signed records (and if not, there will be eventually I'm sure), but even if Comcast wasn't futzing with your dataz, you wouldn't have a functional internet.
(I'm on comcast, and am not seeing this redirection. I also run a local DNS resolver.)
Parent
Re:Confirmed. (Score:4, Funny)
Parent
Re:Just run BIND in your computer (Score:4, Informative)
And your recursive DNS server performs its own lookups via requests on port 53 to the root servers, which get intercepted by Comcast, ...
Parent
Re:Port 53 Rerouted in Seattle :| (Score:4, Informative)
Your netalyzr results show no DNS issues in the link you posted, using a Comcast DNS server:
Parent
Re:Not surprised (Score:4, Insightful)
The only way I can imagine they'd profit from this is by blocking access to alternative DNS servers like OpenDNS, or even just putting in well-known public DNS servers like 4.2.2.2, so that they can intercept unknown requests and return ad-laden pages instead. Basically typosquatting.
Various ISPs have gone down this road before. (Rogers Cable [slashdot.org] has tried, and so has Road Runner [slashdot.org].) Unfortunately -- for the shady ISPs, anyway -- it's easy for annoyed users to get around these schemes; they can just configure their computer or NATing router to use a different DNS server besides the one supplied by the ISP via DHCP.
By transparently redirecting all DNS requests to their own servers, Comcast would eliminate this method of circumventing their advertising. They could also block sites at the DNS level much more easily than before.
A lot of censorship schemes (ab)use DNS in order to return a bogus result to a query; these schemes aren't very good, though, because any user with two brain cells to rub together and the tiniest bit of motivation can change their DNS configuration to use clean servers instead. By doing transparent redirection, you prevent this.
Those strike me as the two obvious reasons. The profit-motivated one (squatting on failed DNS queries) is annoying and causes many non-web applications to fail or behave improperly, but it's not nearly as bad as the censorship-motivated one is. However, the same technique that makes failed-lookup ads harder to avoid could easily be used as part of a censorship scheme if demanded by the government. It's important that even casual Internet users (who may not really care about returning a "page not found" web page instead of the normal browser message) understand why letting their ISP monkey with DNS lookups is a Really Bad Idea.
In both cases you can get around the hijacking by using a VPN and forcing DNS queries though it, but that's significantly harder than changing from automatically-assigned DNS servers to well-known ones like OpenDNS's or Verisign's.
Parent