A semi-anonymous reader writes "In the latest blow to DNS neutrality, Comcast is starting to redirect users to an ad-laden holding page when they try to connect to nonexistent domains. I have just received an email from them to that effect, tried it, and lo and behold, indeed there is the ugly DNS hijack page. The good news is that the opt-out is a more sensible registration based on cable modem MAC, rather than the deplorable 'cookie method' we just saw from Bell Canada. All you Comcast customers and friends of Comcast customers who want to get out of this, go here to opt out. Is there anything that can be done to stop (and reverse) this DNS breakage trend that the ISPs seem to be latching onto lately? Maybe the latest net neutrality bill will help."Update: 08/05 20:03 GMT by T: Here's a page from Comcast with (scant) details on the web-jacking program, which says that yesterday marked the national rollout.
I'm not an expert on DNS. Can someone explain to me, as simply as possible, why this is a bad thing? I understand that it's a pain to be redirected to some random ad-laden piss-poor search page, but what will this break?
This is not a troll or flamebait, I genuinely want some education.
You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.
The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.
Instead, your employee's computer gets Comcast's search page server. Their mail client times out.
You get inundated with tech support calls.
I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network... If you meant:
The computer tries to resolve webmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.
... then it almost makes sense... but only if you have a poorly constructed hosts file and route.
by Anonymous Coward
on Wednesday August 05, @02:50PM (#28962063)
It's a split tunnel VPN...
That means first it tries to use the internet, then it tries the VPN. If I lookup foo.bar, and foo.bar doesn't resolve, it then tries on the VPN's DNS. That helps keep external traffic off the VPN. Internal traffic is still safe.
Of course, if foo.bar instead of not resolving--points to comcast--then I never do the lookup...and the VPN...is broken.
We're talking about the DNS search, not actual routing. First you check the internet and then you search the VPN DNS. This is so that if $work is doing the same type of redirection (which is fine - it's their resources that they're serving, so if they don't want you going to playboy.com, that's their business) you can still reach the external network without using $work's resources. There's no reason why your employer's computer-use policies should interact with your home use, even when connected to the office over VPN.
This requires that your DNS is resolved via the internet before VPN. And requires that the internet DNS behaves properly.
To use an example from my company, we have many users with laptops. We have set up MS Outlook on these systems to use Outlook Anywhere. The way Outlook Anywhere works is that is first tries to connect to the internal mail server (mail.company.inside) and if it can't connect to that then tries the external mail sever for an Outlook Anywhere connection (mail.company.com). With a properly set up and unmunged DNS, when they are at home it tries to connect to the internal server and gets a DNS not found response and then tries the external server. With this new bothced DNS setup, it tries the internal server and gets an IP address response, so it tries to connect to that server to retrieve it's email. Unfortunately, the DNS sends the IP address of the web server that serves up it's ad page, so Outlook sits and times out waiting for a response, meaning these people can't get their email from home.
Yes, this could be worked around by host files, but we are 1000 person company. Why would we want to try setting up local host files on these systems that then have to be updated whenever we change servers just because an ISP doesn't want to set up DNS based on the proper specs?
Arguably this is less of a problem for an organisation like yours that [ostensibly] has some sort of deployment mechanism. You can probably easily configure your employees' laptops to use RFC-compliant DNS servers, whether yours or "public" ones.
That certainly doesn't make it any less evil on Comcast's part, though.
Which seems like a good idea until they come in house. While they are at home and pointing to a RFC-compliant DNS server, it's great, but when they come in-house, they then can't see any of the internal servers because they are still looking at the external DNS server instead of the internal ones given by DHCP. It really is a no win situation.
This may be "how it's done" but relying on something Not Being There is just a terrible idea.
Instead of having two different things to look up (mail.company.inside and mail.company.com) just use the one visible from the outside - mail.company.com. Surely the routers inside the company can catch that request and recognize it as coming from within the company. Relying on failure is bad, bad idea - even if Microsoft does it.
Also, you don't have to use Comcast DNS even if you are using Comcast. If it's a compan
The name of the box is, of course, irrelevant. But you still have it wrong: Comcast's DNS server isn't affecting the company's internal DNS server, it is affecting their customer's box, who is your employee, making it so that they never query your internal DNS server.
This happens precisely because they don't know anything about the internal network, and yet they are telling your employee they do.
I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network...
That's because you didn't pay attention to the scenario. We're talking about a split tunnel VPN. DNS resolution uses the following rules:
1) try the usual (external) DNS server first. If it resolves, use that IP address for the communication. 2) try the internal DNS (via the VPN) if step 1 returned NXDOMAIN, and if that resolves, use that IP address for the communication. 3) otherwise, return NXDOMAIN.
So if Comcast's external server returns a valid IP for the internal server, instead of NXDOMAIN, then your internal mail server will never be accessible to anyone using your company's VPN from a Comcast connection.
A hard-coded IP address in the hosts file is often a bad idea. A simple example: when I'm on-site, company.com resolves to the internal (10.x.x.x) address, but when I'm off-site, company.com resolves to the public address. When employees are on-site, you want traffic to stay on the network, and using the external IP could cause your internal traffic to be routed out of your network and right back in.
Using DNS lookups to tarpit certain kinds of spam. If everything resolves, then such methods simply fail.
Besides, interfering with DNS resolution is just plain bad. Quite frankly, I wish we had an organization controlling the root servers that had a backbone, and would simply stop answering queries from any network that decided to interfere with DNS resolution.
Your example fails because internalmail.company.com will resolve through company.com, not dnsshill.comcast.com. That is "company.com" is authoritative for "internalmail.company.com" in the hierarchical name service system. The questions of what happens in this case is questionable. Especially since in your split tunnel you probably have prepended company.com's internal DNS resolvers in the name search space so that the VPN user sees the internal sites in preference to the external ones.
It's not being redirected to some search page that's the major problem. DNS is a lower-level function that the Web. Really what it's doing is replacing DNS responses indicating that a host or domain doesn't exist with a DNS response indicating that the host/domain is located at X IP address (the address of the search page). It doesn't know when it sends this response what the response will be used for. If it's for the web, you get the search page. Non-web applications will instead behave incorrectly or, at
If all you ever use is the web, that's the extent of your issue.
Now, say your im program is set to try several different dns addresses to connect. If one has been decommissioned (but the client not updated) and your IM will try to connect, possibly passing the username and password to the server that is returned by dns for "login2.whatever.com".
Even with the web, say you have a login for a store/bank/whatever, but the latest version of there page some web developer made a typo and instead of "placeyouw
My ISP does this. They also have an 'opt-out' option, but you know what that does? It still doesn't send an NXDOMAIN response like it should. Instead it redirects me to a site that is serving the standard windows site-not-found page. A horrifying experience for this mac/linux user.
So I set up my own DNS server, which fixed the problem and sped up my internet connection since the ISP's DNS server was really slow.
DNS is supposed to tell you (essentially) "no such domain name registered" when you try to find a domain name.
IFF (e.g. if and only if) DNS _only_ serviced web browsers, then one noise-page (my adverts here) is no different than any other noise page (no such name) because a human is going to go "oh, that's not what I was looking for".
But there is a heck of a lot more going on out here in the internet than just web browsing, and significant portions of it hinge on getting true and correct answers from the DNS system.
With DNS boned-up to return false positives on all names, then money can be stolen from you, the causal web browser. For instance, I send you an email from support@bankofamercia.com; you don't notice the transposition of letters, your spam filter looks up bankofamercia.com and the DNS service return as IP address instead of no such address, that address is the same one as I spoofed in the email, the spam filter says its a good email, you get owned.
Okay, that _is_ contrived, so try this instead...
It's 1964. You are at a pay phone. Your car has broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and you get a busy signal, and you get your dime back. You call home again and get help. The system worked.
It's 1964. You are at a pay phone. Your car is broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and some random person answers and proceeds to try to sell you car wax. Your dime is gone. You are still stuck. The system has failed.
Imagine your life if you _never_ got a busy signal. You call any extension in any company and you get to leave a voice mail but nobody will ever get that message. It would be living hell.
Worse yet, you run a small company, you may a small number of sales each month that are vital to your companies survival. You invest in an expensive advertisement on the superbowl and everything goes great. Then your DNS server dies. Now there is nobody to answer the proper DNS queries. The DNS squatter wakes up and since mylittlecompany.com no longer resolves, all that traffic goes to the Comcast Advertisement Shill page. In just a few minutes you get your DNS server working again, but everyone who got the bogus page thinks your company is trying to sell comcast telephone service and web search services and you never go that business. You are out big cash and your name is ruined. IF the spamvertisement page hadn't been there, those people might instead be thinking "wow, this service is so popular I cannot get in, maybe I'll try back in a bit" instead of "why did comcast decide to take out a superbowl ad that made it look like they sold that interesting little product?"
In short, what if every time your cell phone couldn't be found (because it was off or the battery died etc) the people trying to call you got silently redirected to a random "service" of the type one sees on late night television, offering jokes or sex chat, ostensibly in your good name?
The page you get from Comcast (or whoever) is the same as getting the busy signal/number not found.
A busy signal doesn't try to sell you ads, so it makes sense. Also, we already have something that is the same as a busy signal -- it's called NXDOMAIN.
They're also irrelevant for mail delivery, as last time I checked, mail wasn't sent via HTTP.
Which is one of the main points here -- if it's HTTP, especially if it's HTML over HTTP to a web browser, then getting Comcast's page probably wouldn't bother you any more than getting Firefox's "not found" page. It might use slightly more bandwidth, but it wouldn't really be an issue.
The problem comes when you start doing things like mail delivery, or any number of other applications, which expect nonexistent domains to be, well, nonexistent. Many of them will never fire an HTTP request, and so could not even theoretically figure out WTF is going on -- they get a "connection refused", at best, and maybe they have to wait for a timeout, instead of an immediate domain-not-found error.
It's especially harmful for various applications which depend on actual domain-not-found results, such as various VPN setups. This is more or less exactly like the analogy given -- the payphone giving you your dime back depends on getting an actual, real busy signal and/or "not in service" result. Anything else, and it assumes you were successful, and does the wrong thing -- in this case, it eats your dime.
The opt-out is pretty easy, and I've also sent an email to comcast regarding this.
Hello lothos,
We received your email regarding the easy opt-out, and we would like to take the time to assure you that we are doing everything in our power to make this much more difficult. We apologize for any conveniance you may have encountered, and thank you for being a valued Comcast customer!
I've always used a linux box as my firewall/router box at home, and I've been running BIND as a caching DNS server. Fortunately this won't affect me, as I totally bypass spamcast's bullshit.
No new legislation is needed. Just get the courts involved. Let content providers sue the heck out of Comcast for making a dime off of abusing their domain names. The ISPs think that Google, etc. are "using their pipes to make money," well this is using the content provider's domain and brand to make money. Technical details aside, the effect on the relationship between the content provider and their users is the same whether it is literally hijacking control over the subdomains or creating the perception to user that that is happening. No matter what Comcast may claim, they are altering the relationship between the domain holders and their users.
Now we just need as many people as we can get, whom have a domain name which is trademarked, to press charges against comcast under this law for your own domain.
`(i) an award of statutory damages in the amount of--
`(I) not less than $1,000 or more than $100,000 per trademark per identifier, as the court considers just; or
`(II) if the court finds that the registration or use of the registered trademark as an identifier was willful, not less than $3,000 or more than $300,000 per trademark per identifier, as the court considers just; and
`(ii) full costs and reasonable attorney's fees.
Chances are since the main purpose of this change is for ad revenue, and not a willful infringement, only line (I) will apply. Additionally, you probably can't get the 'bad faith' additions applied, unless you can somehow prove the ads served on their 'page not found' fake-page happen to be ads for your competition.
But a minimum of $1000 plus attorney fee's is pretty decent if you have nothing better to do...
So if you are trying to pen test some machines you own and Comcast points you to their server who is to blame? Are you really responsible if Comcast hijacks your DNS requests and sends you to their server?
I was testing against a known invalid DNS entry (ie: personally owned but not parked domain name). How are you responsible when they hijack your connection?
Even better is when someone pwns Comcast's server and and exploits all of Comcast's customers with a browser exploit hosted there.
They've got about 3 million subscribers in the NY metro area (CT, NJ and NY excluding Manhattan). They just started doing this a couple of months ago. I noticed it when my DNS queries started failing completely. Seems I had changed my DNS servers to ones not owned by Optimum (aka Cablevision) because of speed issues, and with their most recent change they're also blocking DNS queries directed to servers other than their own.
Don't look for the latest net neutrality bill to fix this. All that is is the ISPs making the bag of bribes bigger until the greed of Congress can no longer resist.
The biggest is because Comcast gives very long DHCP leases, and the change doesn't propagate to your system until your access device gets a new DHCP lease.
The second is they probably batch updates to the DHCP server to say who's opted-out.
If you want to have it go faster, after going to the opt-out site, reset your cable modem and your NAT box and it will probably take effect right away. If that doesn't work, wait an hour and try again.
b: IF you had manually set your DNS resolver to a Comcast server, you are unaffected (they added new resolver addresses to do this), per previous discussions by the Comcast folks over at Broadband Reports.
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
I don't like NXDOMAIN wildcarding (it was one of the motivations behind building the ICSI Netalyzr), but if an ISP is going to do it, Comcast's is actually well constructed to both limit collateral damage (it only gets www.*) and be able to be bypassed with a real opt-out.
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
You can run more than just web sites on a www. domain.
Yes, but it's poor practice to advertise anything but a webserver through a www.* IP name. If the host is doing something else, it should have another IP name for people accessing that function. Among other things, it makes it much easier to move that function off that machine without touching the webserver. www.* could affect things other than webservers, but it shouldn't, and mostly, it won't. That doesn't make what Comcast is doing *right*, but it does make it slightly less horribly awful. Slightly.
The other side of the coin is the customer experience. Think about the average internet user. They cannot tell the difference between a 404 error and a 504 error.
People often unknowingly mistype URLs and automatically believe that their internet is broken and they need to call their ISP in order to get it working again. My personal experience working tech support for a large ISP is that mistyping domain names is a huge call driver, and this service is meant to address that.
Look at the DomainHelperLogic [comcast.net] and the only thing it hijacks are DNS lookups that begin with www and end with a valid TLD (.com, a ccTLD like.us, etc.).
While I think this still stinks that they are hijacking DNS at all, and as a Comcast customer I will complain and opt-out, I think they're doing it in a fairly logical way.
But it's not that bad. If you do a DNS lookup for any domain (say for an MX or NS record) you're never going to see this. Your lookups will only be affected if the query starts with www, followed by a domain, ending with a valid TLD (.com, a CC, etc.).
If your internal office uses something such as mycompany.internal, then even a www.mycompany.internal query isn't going to get hijacked since.internal isn't a valid TLD. If you are using mycompany.com for internal use, you should own mycompany.com externally, and negative replies will still work and not get hijacked.
Again, while I oppose monkeying with DNS, this appears to be fairly well thought out and not anywhere near as bad as most other implementations.
Which, if true, makes the opt-out process even more ludicrous. If I'm at home opting out, shouldn't they just DETECT my mac address, and do the opt-out automatically?
Instead, I had to enter my mac address manually (along with my e-mail address) - and then they told me it would take two business days to go through. (Granted, I got a confirmation e-mail the next day saying it was done, but why isn't this automated?)
It depends how integrated the system is. Your mac is only visible in the IP header until your packet hits a router. At that point your MAC gets stripped off and the router's MAC replaces it. I am assuming that your packet would pass through a router before hitting the web page, so it isn't as easy as reading the source address of the packet.
I guessing that when you opt-out, you give them your MAC so that they can assign you to a different IP address pool. Then they just decide if you get hijacked or no
They know which MAC address currently has the lease for which IP address, and they know which customer owns which MAC address. They also know which IP addresses belong to them, so they can separate "people opting out from home" from "people trying to opt out from work".
At least this story doesn't have OpenDNS in the "from the X department" this time. OpenDNS does exactly the same thing, so you might as well stick with your comcast servers.
There shouldn't be any hijack page, simple as that. And yes, you can register an account for OpenDNS. But why would anybody here be advocating standards-breaking, overcomplicated, web-based nonsense?
There is nothing wrong with Treewalk, which is why I didn't mention it.
Excuse my while I go blow a bloodvessel. Every single time a story like this comes up some idiot suggests OpenDNS and idiot mods initially mod them up.
I'd link where this happened last time but for the life of me I can't figure out how to view more than my several dozen posts.
DNS hijacking isn't evil because the companies that do it is evil. It's evil because it breaks standards, and therefore breaks all sorts of other crap.
It doesn't matter what company does it, it's still fucked up. To suggest that OpenDNS breaking standards is any better than Comcast breaking standards is just plain stupid and clearly missing the point entirely.
Because after all, if I don't use their DNS, why should I care where they are directing non-existant domain traffic to?
Using OpenDNS, Treewalk, ns1.sprintlink.net, etc doesn't matter because a) Returning the A record when the domain does not exist blatantly violates the RFCs: the established commonly agreed upon standards without which the internet would cease to function and b) some ISPs redirect your DNS traffic to their servers whether you like it or not. Some outright block DNS servers that don't belong to them, and others silently redirect your requests. c) In the README file of your latest application, you shouldn't have to tell everyone that they need to use your DNS servers just to get a *correct* response.
It isn't just you at home with your pr0n that has to deal with this BS. I have to deal with it where I work, because my company's ISP is a cable provider who does this redirect crap. So when I go to write an app that *might* use DNS, I have to screw with this nonsense because the cableco can't be bothered to return an NX - but instead always returns an A record for their server - subject to change without notification. So when they change to redirect to another server, wtf am I supposed to do then? The only way my app could possibly tell there was a problem is to see if the response matches this redirect server. And no, it isn't an option for my application to just willy nilly pick a DNS server of its choice to use. My application requests a lookup from the OS's network layer, but has no particular knowledge of the DNS servers - exactly how it is supposed to be.
If I give my app to other people, are they supposed to put into the app's configuration the A record information that would correspond to their particular ISP's "redirect" host? My app needs to know when the DNS lookup failed. I have no way to tell when every damn name returns an A record. I count on the DNS server to respond in the way the RFCs set out. Comcast and the other ISPs are saying "fuck your rules"
As has been said until we're blue in the face:The internet is not the web. If the ISPs and the browser folks want to sit down and see what the RFC permits and figure out how to return a url in the NX that the browser would recognize and could handle, then I have no problem with that. As long as it doesn't interfere with the normal operation of an NX response. As I'm sitting here thinking about it, the place for this information seems to be either in the DHCP lease, or in the wpad.dat auto-proxy configuration file. But Comcast and the others like them have decided they don't have to play well with others.
Serious question (Score:3, Funny)
I'm not an expert on DNS. Can someone explain to me, as simply as possible, why this is a bad thing? I understand that it's a pain to be redirected to some random ad-laden piss-poor search page, but what will this break?
This is not a troll or flamebait, I genuinely want some education.
Re:Serious question (Score:5, Informative)
You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.
The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.
Instead, your employee's computer gets Comcast's search page server. Their mail client times out.
You get inundated with tech support calls.
Parent
Re: (Score:3, Funny)
You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.
The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.
Instead, your employee's computer gets Comcast's search page server. Their mail client times out.
You get inundated with tech support calls.
I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network... If you meant:
The computer tries to resolve webmail.company.com , and normally this should fail, causing the computer to try the VPN's DNS server.
... then it almost makes sense... but only if you have a poorly constructed hosts file and route.
Re:Serious question (Score:5, Informative)
It's a split tunnel VPN...
That means first it tries to use the internet, then it tries the VPN. If I lookup foo.bar, and foo.bar doesn't resolve, it then tries on the VPN's DNS. That helps keep external traffic off the VPN. Internal traffic is still safe.
Of course, if foo.bar instead of not resolving--points to comcast--then I never do the lookup...and the VPN ...is broken.
Parent
Re:Serious question (Score:4, Informative)
Any reasonable split tunnel VPN program does exactly the opposite - prioritises the VPN DNS settings over the internet.
Not saying the setup Comcast has is good, just saying.
Parent
Re:Serious question (Score:4, Funny)
Allegedly the Cisco client behaves in exactly the way the GP describes.
Parent
Re:Serious question (Score:5, Informative)
We're talking about the DNS search, not actual routing. First you check the internet and then you search the VPN DNS. This is so that if $work is doing the same type of redirection (which is fine - it's their resources that they're serving, so if they don't want you going to playboy.com, that's their business) you can still reach the external network without using $work's resources. There's no reason why your employer's computer-use policies should interact with your home use, even when connected to the office over VPN.
This requires that your DNS is resolved via the internet before VPN. And requires that the internet DNS behaves properly.
Parent
Re:Serious question (Score:5, Interesting)
To use an example from my company, we have many users with laptops. We have set up MS Outlook on these systems to use Outlook Anywhere. The way Outlook Anywhere works is that is first tries to connect to the internal mail server (mail.company.inside) and if it can't connect to that then tries the external mail sever for an Outlook Anywhere connection (mail.company.com). With a properly set up and unmunged DNS, when they are at home it tries to connect to the internal server and gets a DNS not found response and then tries the external server. With this new bothced DNS setup, it tries the internal server and gets an IP address response, so it tries to connect to that server to retrieve it's email. Unfortunately, the DNS sends the IP address of the web server that serves up it's ad page, so Outlook sits and times out waiting for a response, meaning these people can't get their email from home.
Yes, this could be worked around by host files, but we are 1000 person company. Why would we want to try setting up local host files on these systems that then have to be updated whenever we change servers just because an ISP doesn't want to set up DNS based on the proper specs?
Parent
Re: (Score:3, Informative)
Arguably this is less of a problem for an organisation like yours that [ostensibly] has some sort of deployment mechanism. You can probably easily configure your employees' laptops to use RFC-compliant DNS servers, whether yours or "public" ones.
That certainly doesn't make it any less evil on Comcast's part, though.
Re:Serious question (Score:4, Interesting)
Which seems like a good idea until they come in house. While they are at home and pointing to a RFC-compliant DNS server, it's great, but when they come in-house, they then can't see any of the internal servers because they are still looking at the external DNS server instead of the internal ones given by DHCP. It really is a no win situation.
Parent
Re: (Score:3, Insightful)
This may be "how it's done" but relying on something Not Being There is just a terrible idea.
Instead of having two different things to look up (mail.company.inside and mail.company.com) just use the one visible from the outside - mail.company.com. Surely the routers inside the company can catch that request and recognize it as coming from within the company. Relying on failure is bad, bad idea - even if Microsoft does it.
Also, you don't have to use Comcast DNS even if you are using Comcast. If it's a compan
Re:Serious question (Score:5, Informative)
The name of the box is, of course, irrelevant. But you still have it wrong: Comcast's DNS server isn't affecting the company's internal DNS server, it is affecting their customer's box, who is your employee, making it so that they never query your internal DNS server.
This happens precisely because they don't know anything about the internal network, and yet they are telling your employee they do.
Parent
Re:Serious question (Score:5, Informative)
I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network...
That's because you didn't pay attention to the scenario. We're talking about a split tunnel VPN. DNS resolution uses the following rules:
1) try the usual (external) DNS server first. If it resolves, use that IP address for the communication.
2) try the internal DNS (via the VPN) if step 1 returned NXDOMAIN, and if that resolves, use that IP address for the communication.
3) otherwise, return NXDOMAIN.
So if Comcast's external server returns a valid IP for the internal server, instead of NXDOMAIN, then your internal mail server will never be accessible to anyone using your company's VPN from a Comcast connection.
Parent
Re:Serious question (Score:4, Informative)
A hard-coded IP address in the hosts file is often a bad idea. A simple example: when I'm on-site, company.com resolves to the internal (10.x.x.x) address, but when I'm off-site, company.com resolves to the public address. When employees are on-site, you want traffic to stay on the network, and using the external IP could cause your internal traffic to be routed out of your network and right back in.
Parent
Re:Serious question (Score:5, Interesting)
Using DNS lookups to tarpit certain kinds of spam. If everything resolves, then such methods simply fail.
Besides, interfering with DNS resolution is just plain bad. Quite frankly, I wish we had an organization controlling the root servers that had a backbone, and would simply stop answering queries from any network that decided to interfere with DNS resolution.
Parent
Your point is correct, your example is flawed. (Score:3, Informative)
Your example fails because internalmail.company.com will resolve through company.com, not dnsshill.comcast.com. That is "company.com" is authoritative for "internalmail.company.com" in the hierarchical name service system. The questions of what happens in this case is questionable. Especially since in your split tunnel you probably have prepended company.com's internal DNS resolvers in the name search space so that the VPN user sees the internal sites in preference to the external ones.
Your point is correc
Re: (Score:3, Informative)
It's not being redirected to some search page that's the major problem. DNS is a lower-level function that the Web. Really what it's doing is replacing DNS responses indicating that a host or domain doesn't exist with a DNS response indicating that the host/domain is located at X IP address (the address of the search page). It doesn't know when it sends this response what the response will be used for. If it's for the web, you get the search page. Non-web applications will instead behave incorrectly or, at
Re: (Score:3, Informative)
Now, say your im program is set to try several different dns addresses to connect. If one has been decommissioned (but the client not updated) and your IM will try to connect, possibly passing the username and password to the server that is returned by dns for "login2.whatever.com".
Even with the web, say you have a login for a store/bank/whatever, but the latest version of there page some web developer made a typo and instead of "placeyouw
Re:Serious question (Score:5, Informative)
My ISP does this. They also have an 'opt-out' option, but you know what that does? It still doesn't send an NXDOMAIN response like it should. Instead it redirects me to a site that is serving the standard windows site-not-found page. A horrifying experience for this mac/linux user.
So I set up my own DNS server, which fixed the problem and sped up my internet connection since the ISP's DNS server was really slow.
Parent
Very Simple Answer (Score:5, Insightful)
DNS is supposed to tell you (essentially) "no such domain name registered" when you try to find a domain name.
IFF (e.g. if and only if) DNS _only_ serviced web browsers, then one noise-page (my adverts here) is no different than any other noise page (no such name) because a human is going to go "oh, that's not what I was looking for".
But there is a heck of a lot more going on out here in the internet than just web browsing, and significant portions of it hinge on getting true and correct answers from the DNS system.
With DNS boned-up to return false positives on all names, then money can be stolen from you, the causal web browser. For instance, I send you an email from support@bankofamercia.com; you don't notice the transposition of letters, your spam filter looks up bankofamercia.com and the DNS service return as IP address instead of no such address, that address is the same one as I spoofed in the email, the spam filter says its a good email, you get owned.
Okay, that _is_ contrived, so try this instead...
It's 1964. You are at a pay phone. Your car has broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and you get a busy signal, and you get your dime back. You call home again and get help. The system worked.
It's 1964. You are at a pay phone. Your car is broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and some random person answers and proceeds to try to sell you car wax. Your dime is gone. You are still stuck. The system has failed.
Imagine your life if you _never_ got a busy signal. You call any extension in any company and you get to leave a voice mail but nobody will ever get that message. It would be living hell.
Worse yet, you run a small company, you may a small number of sales each month that are vital to your companies survival. You invest in an expensive advertisement on the superbowl and everything goes great. Then your DNS server dies. Now there is nobody to answer the proper DNS queries. The DNS squatter wakes up and since mylittlecompany.com no longer resolves, all that traffic goes to the Comcast Advertisement Shill page. In just a few minutes you get your DNS server working again, but everyone who got the bogus page thinks your company is trying to sell comcast telephone service and web search services and you never go that business. You are out big cash and your name is ruined. IF the spamvertisement page hadn't been there, those people might instead be thinking "wow, this service is so popular I cannot get in, maybe I'll try back in a bit" instead of "why did comcast decide to take out a superbowl ad that made it look like they sold that interesting little product?"
In short, what if every time your cell phone couldn't be found (because it was off or the battery died etc) the people trying to call you got silently redirected to a random "service" of the type one sees on late night television, offering jokes or sex chat, ostensibly in your good name?
That's what is wrong with doing that.
Parent
Re:Very Simple Answer (Score:4, Informative)
The page you get from Comcast (or whoever) is the same as getting the busy signal/number not found.
A busy signal doesn't try to sell you ads, so it makes sense. Also, we already have something that is the same as a busy signal -- it's called NXDOMAIN.
They're also irrelevant for mail delivery, as last time I checked, mail wasn't sent via HTTP.
Which is one of the main points here -- if it's HTTP, especially if it's HTML over HTTP to a web browser, then getting Comcast's page probably wouldn't bother you any more than getting Firefox's "not found" page. It might use slightly more bandwidth, but it wouldn't really be an issue.
The problem comes when you start doing things like mail delivery, or any number of other applications, which expect nonexistent domains to be, well, nonexistent. Many of them will never fire an HTTP request, and so could not even theoretically figure out WTF is going on -- they get a "connection refused", at best, and maybe they have to wait for a timeout, instead of an immediate domain-not-found error.
It's especially harmful for various applications which depend on actual domain-not-found results, such as various VPN setups. This is more or less exactly like the analogy given -- the payphone giving you your dime back depends on getting an actual, real busy signal and/or "not in service" result. Anything else, and it assumes you were successful, and does the wrong thing -- in this case, it eats your dime.
Parent
Re: (Score:3, Funny)
Interfering with established web protocols could be, for a private citizen, prosecuted as a criminal act.
*sigh*, don't you think that's just a tad extreme?
Obviously you might enjoy it if they cleaned out all the trolls
Are you kidding? I only come here for the trolls ;)
Repeat? (Score:3, Insightful)
Is it just me or was this story on slashdot like three weeks ago? And I complained then? And we all opted out?
Re: (Score:3, Informative)
I noticed this yesterday (Score:4, Interesting)
I noticed this yesterday, and they only seem to hijack www.example.com, and not example.com or ftp.example.com.
Still a pain in the ass, and I'm in the process of opting-out. The opt-out is pretty easy, and I've also sent an email to comcast regarding this.
Re: (Score:3, Funny)
The opt-out is pretty easy, and I've also sent an email to comcast regarding this.
Hello lothos,
We received your email regarding the easy opt-out, and we would like to take the time to assure you that we are doing everything in our power to make this much more difficult. We apologize for any conveniance you may have encountered, and thank you for being a valued Comcast customer!
Best Regards,
Comcast Support
fucking idiots.....at least I have BIND (Score:5, Informative)
I've always used a linux box as my firewall /router box at home, and I've been running BIND as a caching DNS server. Fortunately this won't affect me, as I totally bypass spamcast's bullshit.
The flip side of net neutrality (Score:4, Interesting)
No new legislation is needed. Just get the courts involved. Let content providers sue the heck out of Comcast for making a dime off of abusing their domain names. The ISPs think that Google, etc. are "using their pipes to make money," well this is using the content provider's domain and brand to make money. Technical details aside, the effect on the relationship between the content provider and their users is the same whether it is literally hijacking control over the subdomains or creating the perception to user that that is happening. No matter what Comcast may claim, they are altering the relationship between the domain holders and their users.
Re:The flip side of net neutrality (Score:4, Informative)
No new legislation is needed. Just get the courts involved.
Exactly. This act is already illegal. It is called typo-squatting.
http://thomas.loc.gov/cgi-bin/query/z?c106:S.1255.IS:= [loc.gov]
Specifically, see section 3, (2)(a), and probably (2)(b) as well.
Now we just need as many people as we can get, whom have a domain name which is trademarked, to press charges against comcast under this law for your own domain.
`(i) an award of statutory damages in the amount of--
`(I) not less than $1,000 or more than $100,000 per trademark per identifier, as the court considers just; or
`(II) if the court finds that the registration or use of the registered trademark as an identifier was willful, not less than $3,000 or more than $300,000 per trademark per identifier, as the court considers just; and
`(ii) full costs and reasonable attorney's fees.
Chances are since the main purpose of this change is for ad revenue, and not a willful infringement, only line (I) will apply.
Additionally, you probably can't get the 'bad faith' additions applied, unless you can somehow prove the ads served on their 'page not found' fake-page happen to be ads for your competition.
But a minimum of $1000 plus attorney fee's is pretty decent if you have nothing better to do...
Parent
"Accidently" Hacking their Server (Score:5, Interesting)
So if you are trying to pen test some machines you own and Comcast points you to their server who is to blame? Are you really responsible if Comcast hijacks your DNS requests and sends you to their server?
I was testing against a known invalid DNS entry (ie: personally owned but not parked domain name). How are you responsible when they hijack your connection?
Even better is when someone pwns Comcast's server and and exploits all of Comcast's customers with a browser exploit hosted there.
comcast sponsors standards work on this topic (Score:4, Informative)
http://tools.ietf.org/html/draft-livingood-dns-redirect-00
note where author works.
Optimum Online in NY also started recently (Score:3, Informative)
They've got about 3 million subscribers in the NY metro area (CT, NJ and NY excluding Manhattan). They just started doing this a couple of months ago. I noticed it when my DNS queries started failing completely. Seems I had changed my DNS servers to ones not owned by Optimum (aka Cablevision) because of speed issues, and with their most recent change they're also blocking DNS queries directed to servers other than their own.
Don't look for the latest net neutrality bill to fix this. All that is is the ISPs making the bag of bribes bigger until the greed of Congress can no longer resist.
It still takes 2 days to opt-out. (Score:5, Funny)
Your opt-out request has been confirmed. We will complete processing of this request within 2 business days.
I wonder if /.ing the Comcast request page makes it take longer. ;-)
Re:It still takes 2 days to opt-out. (Score:4, Informative)
The latency comes from two factors.
The biggest is because Comcast gives very long DHCP leases, and the change doesn't propagate to your system until your access device gets a new DHCP lease.
The second is they probably batch updates to the DHCP server to say who's opted-out.
If you want to have it go faster, after going to the opt-out site, reset your cable modem and your NAT box and it will probably take effect right away. If that doesn't work, wait an hour and try again.
Parent
Comcast's version is orders of magitude better... (Score:5, Informative)
Comcast's version is an order of magnitude better than everybody else's.
a: There is a REAL opt-out, that puts your DHCP lease to point to a DNS resolver that doesn't do this. I'll have to do this when I get home. Compare this with, eg, Verizon's pitiful opt-out instructions involving manually changing DNS settings [verizon.net].
b: IF you had manually set your DNS resolver to a Comcast server, you are unaffected (they added new resolver addresses to do this), per previous discussions by the Comcast folks over at Broadband Reports.
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
I don't like NXDOMAIN wildcarding (it was one of the motivations behind building the ICSI Netalyzr), but if an ISP is going to do it, Comcast's is actually well constructed to both limit collateral damage (it only gets www.*) and be able to be bypassed with a real opt-out.
Re: (Score:3, Interesting)
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
You can run more than just web sites on a www. domain.
Re:Comcast's version is orders of magitude better. (Score:4, Informative)
Yes, but it's poor practice to advertise anything but a webserver through a www.* IP name. If the host is doing something else, it should have another IP name for people accessing that function. Among other things, it makes it much easier to move that function off that machine without touching the webserver. www.* could affect things other than webservers, but it shouldn't, and mostly, it won't. That doesn't make what Comcast is doing *right*, but it does make it slightly less horribly awful. Slightly.
Parent
there are two sides to this coin (Score:5, Interesting)
The other side of the coin is the customer experience. Think about the average internet user. They cannot tell the difference between a 404 error and a 504 error.
People often unknowingly mistype URLs and automatically believe that their internet is broken and they need to call their ISP in order to get it working again. My personal experience working tech support for a large ISP is that mistyping domain names is a huge call driver, and this service is meant to address that.
That's the other side, now flame on.
Hold the phone - it's bad, but not that bad (Score:5, Interesting)
Look at the DomainHelperLogic [comcast.net] and the only thing it hijacks are DNS lookups that begin with www and end with a valid TLD (.com, a ccTLD like .us, etc.).
While I think this still stinks that they are hijacking DNS at all, and as a Comcast customer I will complain and opt-out, I think they're doing it in a fairly logical way.
But it's not that bad. If you do a DNS lookup for any domain (say for an MX or NS record) you're never going to see this. Your lookups will only be affected if the query starts with www, followed by a domain, ending with a valid TLD (.com, a CC, etc.).
If your internal office uses something such as mycompany.internal, then even a www.mycompany.internal query isn't going to get hijacked since .internal isn't a valid TLD. If you are using mycompany.com for internal use, you should own mycompany.com externally, and negative replies will still work and not get hijacked.
Again, while I oppose monkeying with DNS, this appears to be fairly well thought out and not anywhere near as bad as most other implementations.
Re:Opt-out page down already? (Score:5, Interesting)
Which, if true, makes the opt-out process even more ludicrous. If I'm at home opting out, shouldn't they just DETECT my mac address, and do the opt-out automatically?
Instead, I had to enter my mac address manually (along with my e-mail address) - and then they told me it would take two business days to go through. (Granted, I got a confirmation e-mail the next day saying it was done, but why isn't this automated?)
Parent
Re: (Score:3, Informative)
I guessing that when you opt-out, you give them your MAC so that they can assign you to a different IP address pool. Then they just decide if you get hijacked or no
Re: (Score:3, Informative)
They know which MAC address currently has the lease for which IP address, and they know which customer owns which MAC address. They also know which IP addresses belong to them, so they can separate "people opting out from home" from "people trying to opt out from work".
Therefore, it could (in theory) be automated.
Not OpenDNS (Score:3, Insightful)
4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6
At least this story doesn't have OpenDNS in the "from the X department" this time.
OpenDNS does exactly the same thing, so you might as well stick with your comcast servers.
WTF? (Score:3, Insightful)
There shouldn't be any hijack page, simple as that.
And yes, you can register an account for OpenDNS. But why would anybody here be advocating standards-breaking, overcomplicated, web-based nonsense?
There is nothing wrong with Treewalk, which is why I didn't mention it.
Re:Treewalk or OpenDNS (Score:5, Informative)
HOLY FUCKING SHIT
STOP SUGGESTING OPENDNS, THEY DO THIS SHIT TOO.
Excuse my while I go blow a bloodvessel. Every single time a story like this comes up some idiot suggests OpenDNS and idiot mods initially mod them up.
I'd link where this happened last time but for the life of me I can't figure out how to view more than my several dozen posts.
Parent
Re:Treewalk or OpenDNS (Score:5, Insightful)
DNS hijacking isn't evil because the companies that do it is evil. It's evil because it breaks standards, and therefore breaks all sorts of other crap.
It doesn't matter what company does it, it's still fucked up. To suggest that OpenDNS breaking standards is any better than Comcast breaking standards is just plain stupid and clearly missing the point entirely.
Parent
Re:Treewalk or OpenDNS (Score:5, Interesting)
Because after all, if I don't use their DNS, why should I care where they are directing non-existant domain traffic to?
Using OpenDNS, Treewalk, ns1.sprintlink.net, etc doesn't matter because a) Returning the A record when the domain does not exist blatantly violates the RFCs: the established commonly agreed upon standards without which the internet would cease to function and b) some ISPs redirect your DNS traffic to their servers whether you like it or not. Some outright block DNS servers that don't belong to them, and others silently redirect your requests. c) In the README file of your latest application, you shouldn't have to tell everyone that they need to use your DNS servers just to get a *correct* response.
It isn't just you at home with your pr0n that has to deal with this BS. I have to deal with it where I work, because my company's ISP is a cable provider who does this redirect crap. So when I go to write an app that *might* use DNS, I have to screw with this nonsense because the cableco can't be bothered to return an NX - but instead always returns an A record for their server - subject to change without notification. So when they change to redirect to another server, wtf am I supposed to do then? The only way my app could possibly tell there was a problem is to see if the response matches this redirect server. And no, it isn't an option for my application to just willy nilly pick a DNS server of its choice to use. My application requests a lookup from the OS's network layer, but has no particular knowledge of the DNS servers - exactly how it is supposed to be.
If I give my app to other people, are they supposed to put into the app's configuration the A record information that would correspond to their particular ISP's "redirect" host? My app needs to know when the DNS lookup failed. I have no way to tell when every damn name returns an A record. I count on the DNS server to respond in the way the RFCs set out. Comcast and the other ISPs are saying "fuck your rules"
As has been said until we're blue in the face:The internet is not the web. If the ISPs and the browser folks want to sit down and see what the RFC permits and figure out how to return a url in the NX that the browser would recognize and could handle, then I have no problem with that. As long as it doesn't interfere with the normal operation of an NX response. As I'm sitting here thinking about it, the place for this information seems to be either in the DHCP lease, or in the wpad.dat auto-proxy configuration file. But Comcast and the others like them have decided they don't have to play well with others.
Parent
Re: (Score:3, Informative)
They do the same thing.... unless you register an account. Why do people always leave that part out?
Re: (Score:3, Informative)
Re: (Score:3, Informative)
I just looked at my cablemodem and it has 4 MAC addresses associated with it:
HFC MAC Address
Ethernet MAC Address (probably not?!)
CM USB MAC Address
CPE USB MAC Address
I suspect that it is the first?
No sense entering it until I know if it makes a difference or just allows the scam to go on.
Thanks!
HFC is the one associated in DOCSIS, so 99% sure it's that one. And you're welcome.