Forgot your password?
typodupeerror
The Internet Networking Businesses Your Rights Online

Comcast the Latest ISP To Try DNS Hijacking 352

Posted by timothy
from the c'mon-fellas dept.
A semi-anonymous reader writes "In the latest blow to DNS neutrality, Comcast is starting to redirect users to an ad-laden holding page when they try to connect to nonexistent domains. I have just received an email from them to that effect, tried it, and lo and behold, indeed there is the ugly DNS hijack page. The good news is that the opt-out is a more sensible registration based on cable modem MAC, rather than the deplorable 'cookie method' we just saw from Bell Canada. All you Comcast customers and friends of Comcast customers who want to get out of this, go here to opt out. Is there anything that can be done to stop (and reverse) this DNS breakage trend that the ISPs seem to be latching onto lately? Maybe the latest net neutrality bill will help." Update: 08/05 20:03 GMT by T : Here's a page from Comcast with (scant) details on the web-jacking program, which says that yesterday marked the national rollout.
This discussion has been archived. No new comments can be posted.

Comcast the Latest ISP To Try DNS Hijacking

Comments Filter:
  • by jabithew (1340853) on Wednesday August 05, 2009 @03:36PM (#28961869)

    I'm not an expert on DNS. Can someone explain to me, as simply as possible, why this is a bad thing? I understand that it's a pain to be redirected to some random ad-laden piss-poor search page, but what will this break?

    This is not a troll or flamebait, I genuinely want some education.

    • Re:Serious question (Score:5, Informative)

      by HeronBlademaster (1079477) <heron@xnapid.com> on Wednesday August 05, 2009 @03:39PM (#28961901) Homepage

      You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.

      The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.

      Instead, your employee's computer gets Comcast's search page server. Their mail client times out.

      You get inundated with tech support calls.

      • Re: (Score:3, Funny)

        You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.

        The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.

        Instead, your employee's computer gets Comcast's search page server. Their mail client times out.

        You get inundated with tech support calls.

        I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network... If you meant:

        The computer tries to resolve webmail.company.com , and normally this should fail, causing the computer to try the VPN's DNS server.

        ... then it almost makes sense... but only if you have a poorly constructed hosts file and route.

        • Re:Serious question (Score:5, Informative)

          by Anonymous Coward on Wednesday August 05, 2009 @03:50PM (#28962063)

          It's a split tunnel VPN...

          That means first it tries to use the internet, then it tries the VPN. If I lookup foo.bar, and foo.bar doesn't resolve, it then tries on the VPN's DNS. That helps keep external traffic off the VPN. Internal traffic is still safe.

          Of course, if foo.bar instead of not resolving--points to comcast--then I never do the lookup...and the VPN ...is broken.

          • Re:Serious question (Score:4, Informative)

            by Kalriath (849904) * on Wednesday August 05, 2009 @05:07PM (#28963229)

            Any reasonable split tunnel VPN program does exactly the opposite - prioritises the VPN DNS settings over the internet.

            Not saying the setup Comcast has is good, just saying.

            • by RegularFry (137639) on Wednesday August 05, 2009 @05:21PM (#28963459)

              Allegedly the Cisco client behaves in exactly the way the GP describes.

            • Re:Serious question (Score:5, Informative)

              by Tanktalus (794810) on Wednesday August 05, 2009 @06:49PM (#28964773) Journal

              We're talking about the DNS search, not actual routing. First you check the internet and then you search the VPN DNS. This is so that if $work is doing the same type of redirection (which is fine - it's their resources that they're serving, so if they don't want you going to playboy.com, that's their business) you can still reach the external network without using $work's resources. There's no reason why your employer's computer-use policies should interact with your home use, even when connected to the office over VPN.

              This requires that your DNS is resolved via the internet before VPN. And requires that the internet DNS behaves properly.

        • Re:Serious question (Score:5, Interesting)

          by dirk (87083) <dirk@one.net> on Wednesday August 05, 2009 @03:54PM (#28962107) Homepage

          To use an example from my company, we have many users with laptops. We have set up MS Outlook on these systems to use Outlook Anywhere. The way Outlook Anywhere works is that is first tries to connect to the internal mail server (mail.company.inside) and if it can't connect to that then tries the external mail sever for an Outlook Anywhere connection (mail.company.com). With a properly set up and unmunged DNS, when they are at home it tries to connect to the internal server and gets a DNS not found response and then tries the external server. With this new bothced DNS setup, it tries the internal server and gets an IP address response, so it tries to connect to that server to retrieve it's email. Unfortunately, the DNS sends the IP address of the web server that serves up it's ad page, so Outlook sits and times out waiting for a response, meaning these people can't get their email from home.

          Yes, this could be worked around by host files, but we are 1000 person company. Why would we want to try setting up local host files on these systems that then have to be updated whenever we change servers just because an ISP doesn't want to set up DNS based on the proper specs?

          • Re: (Score:3, Informative)

            by michaelhood (667393)

            Arguably this is less of a problem for an organisation like yours that [ostensibly] has some sort of deployment mechanism. You can probably easily configure your employees' laptops to use RFC-compliant DNS servers, whether yours or "public" ones.

            That certainly doesn't make it any less evil on Comcast's part, though.

            • Re:Serious question (Score:4, Interesting)

              by dirk (87083) <dirk@one.net> on Wednesday August 05, 2009 @04:18PM (#28962421) Homepage

              Which seems like a good idea until they come in house. While they are at home and pointing to a RFC-compliant DNS server, it's great, but when they come in-house, they then can't see any of the internal servers because they are still looking at the external DNS server instead of the internal ones given by DHCP. It really is a no win situation.

              • Re: (Score:3, Insightful)

                by TheRaven64 (641858)
                Actually, that's (relatively) easy to fix. Just route your traffic to your DNS IP differently depending on whether it comes from the internal or external network.
          • Re: (Score:3, Insightful)

            by scrib (1277042)

            This may be "how it's done" but relying on something Not Being There is just a terrible idea.

            Instead of having two different things to look up (mail.company.inside and mail.company.com) just use the one visible from the outside - mail.company.com. Surely the routers inside the company can catch that request and recognize it as coming from within the company. Relying on failure is bad, bad idea - even if Microsoft does it.

            Also, you don't have to use Comcast DNS even if you are using Comcast. If it's a compan

        • Re:Serious question (Score:5, Informative)

          by Daniel_Staal (609844) <DStaal@usa.net> on Wednesday August 05, 2009 @03:54PM (#28962123)

          The name of the box is, of course, irrelevant. But you still have it wrong: Comcast's DNS server isn't affecting the company's internal DNS server, it is affecting their customer's box, who is your employee, making it so that they never query your internal DNS server.

          This happens precisely because they don't know anything about the internal network, and yet they are telling your employee they do.

        • Re:Serious question (Score:5, Informative)

          by HeronBlademaster (1079477) <heron@xnapid.com> on Wednesday August 05, 2009 @03:56PM (#28962149) Homepage

          I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network...

          That's because you didn't pay attention to the scenario. We're talking about a split tunnel VPN. DNS resolution uses the following rules:

          1) try the usual (external) DNS server first. If it resolves, use that IP address for the communication.
          2) try the internal DNS (via the VPN) if step 1 returned NXDOMAIN, and if that resolves, use that IP address for the communication.
          3) otherwise, return NXDOMAIN.

          So if Comcast's external server returns a valid IP for the internal server, instead of NXDOMAIN, then your internal mail server will never be accessible to anyone using your company's VPN from a Comcast connection.

        • Re:Serious question (Score:5, Interesting)

          by MightyMartian (840721) on Wednesday August 05, 2009 @03:59PM (#28962199) Journal

          Using DNS lookups to tarpit certain kinds of spam. If everything resolves, then such methods simply fail.

          Besides, interfering with DNS resolution is just plain bad. Quite frankly, I wish we had an organization controlling the root servers that had a backbone, and would simply stop answering queries from any network that decided to interfere with DNS resolution.

        • Re: (Score:2, Informative)

          by Anonymous Coward

          OK, here's an example:

          vpn client>> resolve internal.company.com
          correct DNS server<< NXDOMAIN
          vpn client routes VPN connection>> resolve internal.company.com
          company's DNS service<< 10.1.99.12
          result: VPN client knows to use the VPN connection for this route.

          vpn client>> resolve internal.company.com
          ass-backwards DNS server<< address of trojan-ridden.adserve.com
          result: VPN client didn't receive NXDOMAIN, so it won't use the VPN tunnel for this route.
          result 2: any connections a

      • Your example fails because internalmail.company.com will resolve through company.com, not dnsshill.comcast.com. That is "company.com" is authoritative for "internalmail.company.com" in the hierarchical name service system. The questions of what happens in this case is questionable. Especially since in your split tunnel you probably have prepended company.com's internal DNS resolvers in the name search space so that the VPN user sees the internal sites in preference to the external ones.

        Your point is correc

        • Your example fails because internalmail.company.com will resolve through company.com

          Maybe he's using the cisco client - it looks at external DNS first, then tries the VPN DNS. Most companies don't publish their internal DNS to the world, just within the company network.

      • Re: (Score:2, Informative)

        by Anonymous Coward

        You did notice that the page at http://networkmanagement.comcast.net/DomainHelperLogic.htm says it must be preceded by "www." right? That would seem to invalidate your example...

      • Re: (Score:3, Informative)

        by MooUK (905450)

        According to comcast's own pages, their "service" only applies to www.INVALID.tld, and possibly in the future www.INVALID.tdl and www.INVALID - meaning that in all cases it requires www. at the start, only accepts valid tlds at the end at present, and may also intercept invalid or blank tlds at some point in the future.

        To be honest, given that they're doing it anyway, they seem to have chosen a fairly inobtrusive way of doing it.

      • Re: (Score:3, Insightful)

        by zippthorne (748122)

        That sounds weird every time I see it. It puts a lot of the company's security interests (their internal servers) in the hands of a third party (whomever is the "default DNS" for the client). It should check the VPN's DNS first, which perhaps could be an abbreviated "local only" DNS, and only when that fails should it fall over to the "default DNS."

        Or better yet, important servers should be in the hosts file on the client's machine, so that there never is an issue of whether a third party DNS would get ch

    • Re: (Score:2, Informative)

      by Anonymous Coward

      All sorts of stuff. There's many systems that assume a certain behavior - that when a domain doesn't exist, you get an NXDOMAIN response rather than some other record.

      For example, many VPN setups use this to decide which interface to chuck data down. When you try to access 'google.com' that gets a resopnse on the first try, so do that on the public side. When you try 'machine.company' that fails, so go try internal DNS and do it on the internal side.

      I'm sure others can come up with more examples.

    • Re: (Score:3, Informative)

      by blueg3 (192743)

      It's not being redirected to some search page that's the major problem. DNS is a lower-level function that the Web. Really what it's doing is replacing DNS responses indicating that a host or domain doesn't exist with a DNS response indicating that the host/domain is located at X IP address (the address of the search page). It doesn't know when it sends this response what the response will be used for. If it's for the web, you get the search page. Non-web applications will instead behave incorrectly or, at

      • by Shakrai (717556)

        Non-web applications will instead behave incorrectly or, at least, produce an incorrect error message.

        There are applications on the internet that aren't web based? You must be into kiddie porn, software piracy, terrorism or all of the above. Please step away from the computer and await the arrival of the friendly men with the firearms and handcuffs. Don't worry, they are there for your protection.

    • Re: (Score:3, Informative)

      by MaerD (954222)
      If all you ever use is the web, that's the extent of your issue.
      Now, say your im program is set to try several different dns addresses to connect. If one has been decommissioned (but the client not updated) and your IM will try to connect, possibly passing the username and password to the server that is returned by dns for "login2.whatever.com".

      Even with the web, say you have a login for a store/bank/whatever, but the latest version of there page some web developer made a typo and instead of "placeyouw
    • Re:Serious question (Score:5, Informative)

      by Mrs. Grundy (680212) on Wednesday August 05, 2009 @03:49PM (#28962037) Homepage

      My ISP does this. They also have an 'opt-out' option, but you know what that does? It still doesn't send an NXDOMAIN response like it should. Instead it redirects me to a site that is serving the standard windows site-not-found page. A horrifying experience for this mac/linux user.

      So I set up my own DNS server, which fixed the problem and sped up my internet connection since the ISP's DNS server was really slow.

    • Very Simple Answer (Score:5, Insightful)

      by IBitOBear (410965) on Wednesday August 05, 2009 @03:59PM (#28962187) Homepage Journal

      DNS is supposed to tell you (essentially) "no such domain name registered" when you try to find a domain name.

      IFF (e.g. if and only if) DNS _only_ serviced web browsers, then one noise-page (my adverts here) is no different than any other noise page (no such name) because a human is going to go "oh, that's not what I was looking for".

      But there is a heck of a lot more going on out here in the internet than just web browsing, and significant portions of it hinge on getting true and correct answers from the DNS system.

      With DNS boned-up to return false positives on all names, then money can be stolen from you, the causal web browser. For instance, I send you an email from support@bankofamercia.com; you don't notice the transposition of letters, your spam filter looks up bankofamercia.com and the DNS service return as IP address instead of no such address, that address is the same one as I spoofed in the email, the spam filter says its a good email, you get owned.

      Okay, that _is_ contrived, so try this instead...

      It's 1964. You are at a pay phone. Your car has broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and you get a busy signal, and you get your dime back. You call home again and get help. The system worked.

      It's 1964. You are at a pay phone. Your car is broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and some random person answers and proceeds to try to sell you car wax. Your dime is gone. You are still stuck. The system has failed.

      Imagine your life if you _never_ got a busy signal. You call any extension in any company and you get to leave a voice mail but nobody will ever get that message. It would be living hell.

      Worse yet, you run a small company, you may a small number of sales each month that are vital to your companies survival. You invest in an expensive advertisement on the superbowl and everything goes great. Then your DNS server dies. Now there is nobody to answer the proper DNS queries. The DNS squatter wakes up and since mylittlecompany.com no longer resolves, all that traffic goes to the Comcast Advertisement Shill page. In just a few minutes you get your DNS server working again, but everyone who got the bogus page thinks your company is trying to sell comcast telephone service and web search services and you never go that business. You are out big cash and your name is ruined. IF the spamvertisement page hadn't been there, those people might instead be thinking "wow, this service is so popular I cannot get in, maybe I'll try back in a bit" instead of "why did comcast decide to take out a superbowl ad that made it look like they sold that interesting little product?"

      In short, what if every time your cell phone couldn't be found (because it was off or the battery died etc) the people trying to call you got silently redirected to a random "service" of the type one sees on late night television, offering jokes or sex chat, ostensibly in your good name?

      That's what is wrong with doing that.

    • Web browsers aren't the only thing that uses DNS.

      Properly functioning, if your DNS servers fail to respond, the ISP's name servers (that are configured on your system, usually by DHCP) would return an "NXDOMAIN."

      This allows software to correctly inform the user that the host wasn't able to be resolved; when rogue ISPs like Comcast decide to start returning a different (and arguably hostile) IP for a host they can't resolve, instead of returning NXDOMAIN, stuff breaks and causes headaches for software develo

    • The misappropriation is technically bad because it's done at the wrong protocol layer, and even when it works it's bad because it'll cause your browser to do something you didn't want.

      Here's how DNS is supposed to work when it works, and how it's supposed to work when the lookup fails.

      • You have some application that wants to set up a connection to example.com using some protocol.
      • The application sends a query to the DNS servers to find out where example.com lives, gets told "192.9.200.1".
      • The application
  • Repeat? (Score:3, Insightful)

    by HeronBlademaster (1079477) <heron@xnapid.com> on Wednesday August 05, 2009 @03:37PM (#28961877) Homepage

    Is it just me or was this story on slashdot like three weeks ago? And I complained then? And we all opted out?

  • Does anyone have a pointer to clear instructions for setting up a caching nameserver on various platforms and configuring those platforms to use it?

    • by Muad'Dave (255648)
      I have one running one an NSLU2 [wikipedia.org]. There's a tutorial on this site [nslu2-linux.org] somewhere to install linux and configure dnsmasq.
    • On ubuntu:
      sudo apt-get install bind9
      will give you a working caching nameserver.
      This page gives info about maintaining root hints: http://tldp.org/HOWTO/DNS-HOWTO-8.html [tldp.org]

      On windows XP I've been using Posadis which sort of sucks, except when compared to all the others I tried.

    • That may or may not solve the problem, depending on how the ISP is implementing the hyjacking. If they have just set up some records in their DNS boxes, then yes, setting up your own namesever will solve the problem. If they are capturing all UDP port 53 traffic and handling it themselves, then it won't.

  • by lothos (10657) on Wednesday August 05, 2009 @03:38PM (#28961899) Homepage

    I noticed this yesterday, and they only seem to hijack www.example.com, and not example.com or ftp.example.com.

    Still a pain in the ass, and I'm in the process of opting-out. The opt-out is pretty easy, and I've also sent an email to comcast regarding this.

    • I opted out, then I called in and complained. You should too. (You'll note that the opt-out page tells you "this will take 2 business days". Seriously, it should be automated.)

      I figure, if enough of us waste their customer support time (costs them like $8/call), they'll realize we really don't want them to do this, and they'll stop it.

      I'm probably dreaming, though.

    • Re: (Score:3, Funny)

      by dyingtolive (1393037)

      The opt-out is pretty easy, and I've also sent an email to comcast regarding this.

      Hello lothos,
      We received your email regarding the easy opt-out, and we would like to take the time to assure you that we are doing everything in our power to make this much more difficult. We apologize for any conveniance you may have encountered, and thank you for being a valued Comcast customer!

      Best Regards,
      Comcast Support

  • by Indy1 (99447) <spamtrap@fuckedregime.com> on Wednesday August 05, 2009 @03:48PM (#28962017) Homepage

    I've always used a linux box as my firewall /router box at home, and I've been running BIND as a caching DNS server. Fortunately this won't affect me, as I totally bypass spamcast's bullshit.

  • by MikeRT (947531) on Wednesday August 05, 2009 @03:48PM (#28962019) Homepage

    No new legislation is needed. Just get the courts involved. Let content providers sue the heck out of Comcast for making a dime off of abusing their domain names. The ISPs think that Google, etc. are "using their pipes to make money," well this is using the content provider's domain and brand to make money. Technical details aside, the effect on the relationship between the content provider and their users is the same whether it is literally hijacking control over the subdomains or creating the perception to user that that is happening. No matter what Comcast may claim, they are altering the relationship between the domain holders and their users.

    • by dissy (172727) on Wednesday August 05, 2009 @04:25PM (#28962491)

      No new legislation is needed. Just get the courts involved.

      Exactly. This act is already illegal. It is called typo-squatting.

      http://thomas.loc.gov/cgi-bin/query/z?c106:S.1255.IS:= [loc.gov]
      Specifically, see section 3, (2)(a), and probably (2)(b) as well.

      Now we just need as many people as we can get, whom have a domain name which is trademarked, to press charges against comcast under this law for your own domain.

      `(i) an award of statutory damages in the amount of--

            `(I) not less than $1,000 or more than $100,000 per trademark per identifier, as the court considers just; or
            `(II) if the court finds that the registration or use of the registered trademark as an identifier was willful, not less than $3,000 or more than $300,000 per trademark per identifier, as the court considers just; and
            `(ii) full costs and reasonable attorney's fees.

      Chances are since the main purpose of this change is for ad revenue, and not a willful infringement, only line (I) will apply.
      Additionally, you probably can't get the 'bad faith' additions applied, unless you can somehow prove the ads served on their 'page not found' fake-page happen to be ads for your competition.

      But a minimum of $1000 plus attorney fee's is pretty decent if you have nothing better to do...

  • Huh, the link keeps going to something about net neutering. Oh well.

  • Does anyone know which method they're using to intercept the DNS? There was an article on here a few months back about them redirecting all port 53 traffic to their servers ('testing in a small market' or something). Other cases usually just configure the nameservers issued via DHCP to respond for NX records with their A for search pages.

    I ask because if they're redirecting all port 53 traffic, using your own servers (or anyone else's) won't do you much good. Also, it's legality is questionable.
  • by blueskies (525815) on Wednesday August 05, 2009 @03:55PM (#28962131) Journal

    So if you are trying to pen test some machines you own and Comcast points you to their server who is to blame? Are you really responsible if Comcast hijacks your DNS requests and sends you to their server?

    I was testing against a known invalid DNS entry (ie: personally owned but not parked domain name). How are you responsible when they hijack your connection?

    Even better is when someone pwns Comcast's server and and exploits all of Comcast's customers with a browser exploit hosted there.

  • Simply run bind9 on your system. Comcast will not stop you.
  • At least Comcast got the opt-out implementation right. It's done by the cable modem's MAC address, which means that all DNS lookup traffic will start getting NXDOMAIN queries. Oddly, their instructions indicate that this only takes effect when your modem does its next DHCP client lease. My guess is they've blocked off a range of IPs as "opt out," and just assign your MAC to get a lease from the out out range.

    I'd greatly prefer it if Comcast had just left things alone, of course; at least, though, they di

  • by Anonymous Coward on Wednesday August 05, 2009 @04:06PM (#28962275)

    http://tools.ietf.org/html/draft-livingood-dns-redirect-00

    note where author works.

  • I had to jump through hoops to get the hijacking removed from FIOS. There's no way an average user would be able to do it. Verizon's instructions weren't even even accurate, I had to Google to get the right directions that were put up by some bloggers. I'm sure it was all Verizon's intention to keep the direction so cryptic and flat out wrong. Fuck the phone and cable companies and the fuckwad senators and congresspeople that let these sleazebags get away with this shit. I'm so fucking tired of having every
  • by PingXao (153057) on Wednesday August 05, 2009 @04:09PM (#28962319)

    They've got about 3 million subscribers in the NY metro area (CT, NJ and NY excluding Manhattan). They just started doing this a couple of months ago. I noticed it when my DNS queries started failing completely. Seems I had changed my DNS servers to ones not owned by Optimum (aka Cablevision) because of speed issues, and with their most recent change they're also blocking DNS queries directed to servers other than their own.

    Don't look for the latest net neutrality bill to fix this. All that is is the ISPs making the bag of bribes bigger until the greed of Congress can no longer resist.

  • by WarJolt (990309) on Wednesday August 05, 2009 @04:10PM (#28962331)

    Your opt-out request has been confirmed. We will complete processing of this request within 2 business days.

    I wonder if /.ing the Comcast request page makes it take longer. ;-)

    • by nweaver (113078) on Wednesday August 05, 2009 @04:24PM (#28962485) Homepage

      The latency comes from two factors.

      The biggest is because Comcast gives very long DHCP leases, and the change doesn't propagate to your system until your access device gets a new DHCP lease.

      The second is they probably batch updates to the DHCP server to say who's opted-out.

      If you want to have it go faster, after going to the opt-out site, reset your cable modem and your NAT box and it will probably take effect right away. If that doesn't work, wait an hour and try again.

  • If you have about ten minutes be sure to give them a call. Explain to them that they're breaking basic internet functionality, the very service you're paying for.

    No ISP should ever supply bogus dns info for domains they don't own.

  • Cox opt out (Score:2, Insightful)

    by cprocjr (1237004)
    My ISP Cox did this and to opt out of it all you had to do was change your DNS server to another one that they provided. In my opinion this is much better than cookies and router MAC addresses because you can do it on a computer by computer basis.
  • Worked fine, I get the proper NXDOMAIN response. No goofy fake 'domain not found' page, like bellca.

    WTF?!? Yesterday I was getting NXDOMAIN correctly, today I'm back on to their crappy search page! Dammit, I opted out when they first announced this! Comcast, you bastards!

  • The funny thing is that Monday morning I saw Comcast's executive vice president on CSPAN-2 saying that they fully supported the principle of net neutrality.
  • by nweaver (113078) on Wednesday August 05, 2009 @04:19PM (#28962439) Homepage

    Comcast's version is an order of magnitude better than everybody else's.

    a: There is a REAL opt-out, that puts your DHCP lease to point to a DNS resolver that doesn't do this. I'll have to do this when I get home. Compare this with, eg, Verizon's pitiful opt-out instructions involving manually changing DNS settings [verizon.net].

    b: IF you had manually set your DNS resolver to a Comcast server, you are unaffected (they added new resolver addresses to do this), per previous discussions by the Comcast folks over at Broadband Reports.

    c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.

    I don't like NXDOMAIN wildcarding (it was one of the motivations behind building the ICSI Netalyzr), but if an ISP is going to do it, Comcast's is actually well constructed to both limit collateral damage (it only gets www.*) and be able to be bypassed with a real opt-out.

    • Re: (Score:3, Interesting)

      by Hatta (162192) *

      c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.

      You can run more than just web sites on a www. domain.

      • by Chris Mattern (191822) on Wednesday August 05, 2009 @05:19PM (#28963435)

        Yes, but it's poor practice to advertise anything but a webserver through a www.* IP name. If the host is doing something else, it should have another IP name for people accessing that function. Among other things, it makes it much easier to move that function off that machine without touching the webserver. www.* could affect things other than webservers, but it shouldn't, and mostly, it won't. That doesn't make what Comcast is doing *right*, but it does make it slightly less horribly awful. Slightly.

  • WTF, this is old news! There's even a link to the month-old story in the "related stories" box below the summary. Why is Slashdot posting a freakout story that makes it sound like it just came out of nowhere all of a sudden?

  • Qwest (DSL) is doing this too. I knew there was something about it that annoyed me, but I hadn't given it much thought until now, when I can totally see why this is a BAD THING.

  • by not_anne (203907) on Wednesday August 05, 2009 @05:41PM (#28963777)

    The other side of the coin is the customer experience. Think about the average internet user. They cannot tell the difference between a 404 error and a 504 error.

    People often unknowingly mistype URLs and automatically believe that their internet is broken and they need to call their ISP in order to get it working again. My personal experience working tech support for a large ISP is that mistyping domain names is a huge call driver, and this service is meant to address that.

    That's the other side, now flame on.

  • by jroysdon (201893) on Wednesday August 05, 2009 @05:48PM (#28963885) Homepage

    Look at the DomainHelperLogic [comcast.net] and the only thing it hijacks are DNS lookups that begin with www and end with a valid TLD (.com, a ccTLD like .us, etc.).

    While I think this still stinks that they are hijacking DNS at all, and as a Comcast customer I will complain and opt-out, I think they're doing it in a fairly logical way.

    But it's not that bad. If you do a DNS lookup for any domain (say for an MX or NS record) you're never going to see this. Your lookups will only be affected if the query starts with www, followed by a domain, ending with a valid TLD (.com, a CC, etc.).

    If your internal office uses something such as mycompany.internal, then even a www.mycompany.internal query isn't going to get hijacked since .internal isn't a valid TLD. If you are using mycompany.com for internal use, you should own mycompany.com externally, and negative replies will still work and not get hijacked.

    Again, while I oppose monkeying with DNS, this appears to be fairly well thought out and not anywhere near as bad as most other implementations.

  • by jc42 (318812) on Wednesday August 05, 2009 @10:46PM (#28966979) Homepage Journal

    My main question would be: Does Comcast intercept and answer all DNS requests on its wires?

    My reason for asking is that I've generally found that it's not a very good idea to use the ISP's nameservers. They never work very well, in my experience. When I've been responsible for such things, I've generally looked for a few good nameservers that are (electronically) nearby, and tell my machines to use them. I usually get faster and more accurate DNS resolution that way.

    But if the ISP is looking specifically for any DNS requests, ignoring their destination address, and forging an answer that points to their own machine, then the above strategy won't work.

    Yes, forging replies to packets not addressed to you is a nasty thing to do. Comcast has been caught red-handed doing this, e.g. to tell both ends of a P2P connection that the other has closed the connection. So it seems likely that they may be doing the same thing here. But I can't quite tell from what I've read.

"Irrationality is the square root of all evil" -- Douglas Hofstadter

Working...