Comcast the Latest ISP To Try DNS Hijacking 352
A semi-anonymous reader writes "In the latest blow to DNS neutrality, Comcast is starting to redirect users to an ad-laden holding page when they try to connect to nonexistent domains. I have just received an email from them to that effect, tried it, and lo and behold, indeed there is the ugly DNS hijack page. The good news is that the opt-out is a more sensible registration based on cable modem MAC, rather than the deplorable 'cookie method' we just saw from Bell Canada. All you Comcast customers and friends of Comcast customers who want to get out of this, go here to opt out. Is there anything that can be done to stop (and reverse) this DNS breakage trend that the ISPs seem to be latching onto lately? Maybe the latest net neutrality bill will help." Update: 08/05 20:03 GMT by T : Here's a page from Comcast with (scant) details on the web-jacking program, which says that yesterday marked the national rollout.
Serious question (Score:3, Funny)
I'm not an expert on DNS. Can someone explain to me, as simply as possible, why this is a bad thing? I understand that it's a pain to be redirected to some random ad-laden piss-poor search page, but what will this break?
This is not a troll or flamebait, I genuinely want some education.
Re:Serious question (Score:5, Informative)
You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.
The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.
Instead, your employee's computer gets Comcast's search page server. Their mail client times out.
You get inundated with tech support calls.
Re: (Score:3, Funny)
You're IT for a business. You have employees who check their e-mail from home, accessing your stuff via a split tunnel VPN.
The computer tries to resolve internalmail.company.com, and normally this should fail, causing the computer to try the VPN's DNS server.
Instead, your employee's computer gets Comcast's search page server. Their mail client times out.
You get inundated with tech support calls.
I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network... If you meant:
The computer tries to resolve webmail.company.com , and normally this should fail, causing the computer to try the VPN's DNS server.
... then it almost makes sense... but only if you have a poorly constructed hosts file and route.
Re:Serious question (Score:5, Informative)
It's a split tunnel VPN...
That means first it tries to use the internet, then it tries the VPN. If I lookup foo.bar, and foo.bar doesn't resolve, it then tries on the VPN's DNS. That helps keep external traffic off the VPN. Internal traffic is still safe.
Of course, if foo.bar instead of not resolving--points to comcast--then I never do the lookup...and the VPN ...is broken.
Re:Serious question (Score:4, Informative)
Any reasonable split tunnel VPN program does exactly the opposite - prioritises the VPN DNS settings over the internet.
Not saying the setup Comcast has is good, just saying.
Re:Serious question (Score:4, Funny)
Allegedly the Cisco client behaves in exactly the way the GP describes.
Re:Serious question (Score:5, Informative)
We're talking about the DNS search, not actual routing. First you check the internet and then you search the VPN DNS. This is so that if $work is doing the same type of redirection (which is fine - it's their resources that they're serving, so if they don't want you going to playboy.com, that's their business) you can still reach the external network without using $work's resources. There's no reason why your employer's computer-use policies should interact with your home use, even when connected to the office over VPN.
This requires that your DNS is resolved via the internet before VPN. And requires that the internet DNS behaves properly.
Re:Serious question (Score:5, Interesting)
To use an example from my company, we have many users with laptops. We have set up MS Outlook on these systems to use Outlook Anywhere. The way Outlook Anywhere works is that is first tries to connect to the internal mail server (mail.company.inside) and if it can't connect to that then tries the external mail sever for an Outlook Anywhere connection (mail.company.com). With a properly set up and unmunged DNS, when they are at home it tries to connect to the internal server and gets a DNS not found response and then tries the external server. With this new bothced DNS setup, it tries the internal server and gets an IP address response, so it tries to connect to that server to retrieve it's email. Unfortunately, the DNS sends the IP address of the web server that serves up it's ad page, so Outlook sits and times out waiting for a response, meaning these people can't get their email from home.
Yes, this could be worked around by host files, but we are 1000 person company. Why would we want to try setting up local host files on these systems that then have to be updated whenever we change servers just because an ISP doesn't want to set up DNS based on the proper specs?
Re: (Score:3, Informative)
Arguably this is less of a problem for an organisation like yours that [ostensibly] has some sort of deployment mechanism. You can probably easily configure your employees' laptops to use RFC-compliant DNS servers, whether yours or "public" ones.
That certainly doesn't make it any less evil on Comcast's part, though.
Re:Serious question (Score:4, Interesting)
Which seems like a good idea until they come in house. While they are at home and pointing to a RFC-compliant DNS server, it's great, but when they come in-house, they then can't see any of the internal servers because they are still looking at the external DNS server instead of the internal ones given by DHCP. It really is a no win situation.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
This may be "how it's done" but relying on something Not Being There is just a terrible idea.
Instead of having two different things to look up (mail.company.inside and mail.company.com) just use the one visible from the outside - mail.company.com. Surely the routers inside the company can catch that request and recognize it as coming from within the company. Relying on failure is bad, bad idea - even if Microsoft does it.
Also, you don't have to use Comcast DNS even if you are using Comcast. If it's a compan
Re:Serious question (Score:5, Informative)
The name of the box is, of course, irrelevant. But you still have it wrong: Comcast's DNS server isn't affecting the company's internal DNS server, it is affecting their customer's box, who is your employee, making it so that they never query your internal DNS server.
This happens precisely because they don't know anything about the internal network, and yet they are telling your employee they do.
Re: (Score:2)
Re:Serious question (Score:5, Informative)
I fail to see, using your scenario, why Comcast's DNS server would effect the company's internal DNS server, thus creating the conflict you alluded to. Since I'm not sure why Comcast would know anything about the company's internal network...
That's because you didn't pay attention to the scenario. We're talking about a split tunnel VPN. DNS resolution uses the following rules:
1) try the usual (external) DNS server first. If it resolves, use that IP address for the communication.
2) try the internal DNS (via the VPN) if step 1 returned NXDOMAIN, and if that resolves, use that IP address for the communication.
3) otherwise, return NXDOMAIN.
So if Comcast's external server returns a valid IP for the internal server, instead of NXDOMAIN, then your internal mail server will never be accessible to anyone using your company's VPN from a Comcast connection.
Re:Serious question (Score:4, Informative)
A hard-coded IP address in the hosts file is often a bad idea. A simple example: when I'm on-site, company.com resolves to the internal (10.x.x.x) address, but when I'm off-site, company.com resolves to the public address. When employees are on-site, you want traffic to stay on the network, and using the external IP could cause your internal traffic to be routed out of your network and right back in.
Re:Serious question (Score:5, Interesting)
Using DNS lookups to tarpit certain kinds of spam. If everything resolves, then such methods simply fail.
Besides, interfering with DNS resolution is just plain bad. Quite frankly, I wish we had an organization controlling the root servers that had a backbone, and would simply stop answering queries from any network that decided to interfere with DNS resolution.
Re: (Score:2, Informative)
OK, here's an example:
vpn client>> resolve internal.company.com
correct DNS server<< NXDOMAIN
vpn client routes VPN connection>> resolve internal.company.com
company's DNS service<< 10.1.99.12
result: VPN client knows to use the VPN connection for this route.
vpn client>> resolve internal.company.com
ass-backwards DNS server<< address of trojan-ridden.adserve.com
result: VPN client didn't receive NXDOMAIN, so it won't use the VPN tunnel for this route.
result 2: any connections a
Your point is correct, your example is flawed. (Score:3, Informative)
Your example fails because internalmail.company.com will resolve through company.com, not dnsshill.comcast.com. That is "company.com" is authoritative for "internalmail.company.com" in the hierarchical name service system. The questions of what happens in this case is questionable. Especially since in your split tunnel you probably have prepended company.com's internal DNS resolvers in the name search space so that the VPN user sees the internal sites in preference to the external ones.
Your point is correc
Re: (Score:3)
Your example fails because internalmail.company.com will resolve through company.com
Maybe he's using the cisco client - it looks at external DNS first, then tries the VPN DNS. Most companies don't publish their internal DNS to the world, just within the company network.
Re: (Score:2, Informative)
You did notice that the page at http://networkmanagement.comcast.net/DomainHelperLogic.htm says it must be preceded by "www." right? That would seem to invalidate your example...
Re: (Score:3, Informative)
I believe that Firefox (and your browser may do this as well) tries www.domainname.com if domainname.com doesn't exist.
This would explain why the invaliddomain135.net redirected to that page.
Re: (Score:3, Informative)
According to comcast's own pages, their "service" only applies to www.INVALID.tld, and possibly in the future www.INVALID.tdl and www.INVALID - meaning that in all cases it requires www. at the start, only accepts valid tlds at the end at present, and may also intercept invalid or blank tlds at some point in the future.
To be honest, given that they're doing it anyway, they seem to have chosen a fairly inobtrusive way of doing it.
Re: (Score:3, Insightful)
That sounds weird every time I see it. It puts a lot of the company's security interests (their internal servers) in the hands of a third party (whomever is the "default DNS" for the client). It should check the VPN's DNS first, which perhaps could be an abbreviated "local only" DNS, and only when that fails should it fall over to the "default DNS."
Or better yet, important servers should be in the hosts file on the client's machine, so that there never is an issue of whether a third party DNS would get ch
Re: (Score:2, Informative)
All sorts of stuff. There's many systems that assume a certain behavior - that when a domain doesn't exist, you get an NXDOMAIN response rather than some other record.
For example, many VPN setups use this to decide which interface to chuck data down. When you try to access 'google.com' that gets a resopnse on the first try, so do that on the public side. When you try 'machine.company' that fails, so go try internal DNS and do it on the internal side.
I'm sure others can come up with more examples.
Re: (Score:3, Informative)
It's not being redirected to some search page that's the major problem. DNS is a lower-level function that the Web. Really what it's doing is replacing DNS responses indicating that a host or domain doesn't exist with a DNS response indicating that the host/domain is located at X IP address (the address of the search page). It doesn't know when it sends this response what the response will be used for. If it's for the web, you get the search page. Non-web applications will instead behave incorrectly or, at
Re: (Score:2)
Non-web applications will instead behave incorrectly or, at least, produce an incorrect error message.
There are applications on the internet that aren't web based? You must be into kiddie porn, software piracy, terrorism or all of the above. Please step away from the computer and await the arrival of the friendly men with the firearms and handcuffs. Don't worry, they are there for your protection.
Re: (Score:3, Informative)
Now, say your im program is set to try several different dns addresses to connect. If one has been decommissioned (but the client not updated) and your IM will try to connect, possibly passing the username and password to the server that is returned by dns for "login2.whatever.com".
Even with the web, say you have a login for a store/bank/whatever, but the latest version of there page some web developer made a typo and instead of "placeyouw
Re: (Score:2)
Hmm, that bank example is very interesting and one I hadn't heard before. Thanks.
Re:Serious question (Score:5, Informative)
My ISP does this. They also have an 'opt-out' option, but you know what that does? It still doesn't send an NXDOMAIN response like it should. Instead it redirects me to a site that is serving the standard windows site-not-found page. A horrifying experience for this mac/linux user.
So I set up my own DNS server, which fixed the problem and sped up my internet connection since the ISP's DNS server was really slow.
Very Simple Answer (Score:5, Insightful)
DNS is supposed to tell you (essentially) "no such domain name registered" when you try to find a domain name.
IFF (e.g. if and only if) DNS _only_ serviced web browsers, then one noise-page (my adverts here) is no different than any other noise page (no such name) because a human is going to go "oh, that's not what I was looking for".
But there is a heck of a lot more going on out here in the internet than just web browsing, and significant portions of it hinge on getting true and correct answers from the DNS system.
With DNS boned-up to return false positives on all names, then money can be stolen from you, the causal web browser. For instance, I send you an email from support@bankofamercia.com; you don't notice the transposition of letters, your spam filter looks up bankofamercia.com and the DNS service return as IP address instead of no such address, that address is the same one as I spoofed in the email, the spam filter says its a good email, you get owned.
Okay, that _is_ contrived, so try this instead...
It's 1964. You are at a pay phone. Your car has broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and you get a busy signal, and you get your dime back. You call home again and get help. The system worked.
It's 1964. You are at a pay phone. Your car is broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and some random person answers and proceeds to try to sell you car wax. Your dime is gone. You are still stuck. The system has failed.
Imagine your life if you _never_ got a busy signal. You call any extension in any company and you get to leave a voice mail but nobody will ever get that message. It would be living hell.
Worse yet, you run a small company, you may a small number of sales each month that are vital to your companies survival. You invest in an expensive advertisement on the superbowl and everything goes great. Then your DNS server dies. Now there is nobody to answer the proper DNS queries. The DNS squatter wakes up and since mylittlecompany.com no longer resolves, all that traffic goes to the Comcast Advertisement Shill page. In just a few minutes you get your DNS server working again, but everyone who got the bogus page thinks your company is trying to sell comcast telephone service and web search services and you never go that business. You are out big cash and your name is ruined. IF the spamvertisement page hadn't been there, those people might instead be thinking "wow, this service is so popular I cannot get in, maybe I'll try back in a bit" instead of "why did comcast decide to take out a superbowl ad that made it look like they sold that interesting little product?"
In short, what if every time your cell phone couldn't be found (because it was off or the battery died etc) the people trying to call you got silently redirected to a random "service" of the type one sees on late night television, offering jokes or sex chat, ostensibly in your good name?
That's what is wrong with doing that.
Re:Very Simple Answer (Score:4, Informative)
The page you get from Comcast (or whoever) is the same as getting the busy signal/number not found.
A busy signal doesn't try to sell you ads, so it makes sense. Also, we already have something that is the same as a busy signal -- it's called NXDOMAIN.
They're also irrelevant for mail delivery, as last time I checked, mail wasn't sent via HTTP.
Which is one of the main points here -- if it's HTTP, especially if it's HTML over HTTP to a web browser, then getting Comcast's page probably wouldn't bother you any more than getting Firefox's "not found" page. It might use slightly more bandwidth, but it wouldn't really be an issue.
The problem comes when you start doing things like mail delivery, or any number of other applications, which expect nonexistent domains to be, well, nonexistent. Many of them will never fire an HTTP request, and so could not even theoretically figure out WTF is going on -- they get a "connection refused", at best, and maybe they have to wait for a timeout, instead of an immediate domain-not-found error.
It's especially harmful for various applications which depend on actual domain-not-found results, such as various VPN setups. This is more or less exactly like the analogy given -- the payphone giving you your dime back depends on getting an actual, real busy signal and/or "not in service" result. Anything else, and it assumes you were successful, and does the wrong thing -- in this case, it eats your dime.
Re: (Score:3, Informative)
My email example never mentioned, nor does it pivot on, HTTP.
Comcast doesn't "send you an http page" they send you a FALSE ADDRESS RESOLUTION RECORD where your browser then goes to retrieve the bogus page via HTTP. See how the DNS protocol is completely different than the HTTP protocol?
SPAM Filters check to make sure that senders exist (among other things), one of the ways they do this is to look up the domain name to make sure that the sender domain ACTUALLY EXISTS as a first tier check. This is why you d
Re: (Score:2)
Web browsers aren't the only thing that uses DNS.
Properly functioning, if your DNS servers fail to respond, the ISP's name servers (that are configured on your system, usually by DHCP) would return an "NXDOMAIN."
This allows software to correctly inform the user that the host wasn't able to be resolved; when rogue ISPs like Comcast decide to start returning a different (and arguably hostile) IP for a host they can't resolve, instead of returning NXDOMAIN, stuff breaks and causes headaches for software develo
DNS is for IP Layer, not Browser Layer (Score:3, Informative)
The misappropriation is technically bad because it's done at the wrong protocol layer, and even when it works it's bad because it'll cause your browser to do something you didn't want.
Here's how DNS is supposed to work when it works, and how it's supposed to work when the lookup fails.
Re: (Score:3, Funny)
Interfering with established web protocols could be, for a private citizen, prosecuted as a criminal act.
*sigh*, don't you think that's just a tad extreme?
Obviously you might enjoy it if they cleaned out all the trolls
Are you kidding? I only come here for the trolls ;)
Re: (Score:2)
Interfering with established web protocols could be, for a private citizen, prosecuted as a criminal act.
I stopped reading here. Let's save the ridiculous hyperbole for the mainstream media?
Re: (Score:2)
2) anyone care to explain how in the world my host system hits their pages for good sites but the guests usually do not?
Varying DNS configuration in the host/guest OS's?
If you are using a consumer router/gateway device for your WAN, try setting your host and guests' DNS servers to the LAN IP of the router, most will pass DNS queries on to the NS it was given in its' DHCP lease.
Repeat? (Score:3, Insightful)
Is it just me or was this story on slashdot like three weeks ago? And I complained then? And we all opted out?
Re: (Score:3, Informative)
Personal caching nameserver? (Score:2)
Does anyone have a pointer to clear instructions for setting up a caching nameserver on various platforms and configuring those platforms to use it?
Re: (Score:2)
Re: (Score:2)
On ubuntu:
sudo apt-get install bind9
will give you a working caching nameserver.
This page gives info about maintaining root hints: http://tldp.org/HOWTO/DNS-HOWTO-8.html [tldp.org]
On windows XP I've been using Posadis which sort of sucks, except when compared to all the others I tried.
Re: (Score:2)
That may or may not solve the problem, depending on how the ISP is implementing the hyjacking. If they have just set up some records in their DNS boxes, then yes, setting up your own namesever will solve the problem. If they are capturing all UDP port 53 traffic and handling it themselves, then it won't.
I noticed this yesterday (Score:4, Interesting)
I noticed this yesterday, and they only seem to hijack www.example.com, and not example.com or ftp.example.com.
Still a pain in the ass, and I'm in the process of opting-out. The opt-out is pretty easy, and I've also sent an email to comcast regarding this.
Re: (Score:2)
I opted out, then I called in and complained. You should too. (You'll note that the opt-out page tells you "this will take 2 business days". Seriously, it should be automated.)
I figure, if enough of us waste their customer support time (costs them like $8/call), they'll realize we really don't want them to do this, and they'll stop it.
I'm probably dreaming, though.
Re: (Score:2)
No, don't call in for the opt-out. Just call in to complain about the fact that they're doing it at all. Preferably including a lengthy technical description about why it's a terrible idea and breaks the internet.
Re: (Score:2)
No, don't call in for the opt-out. Just call in to complain about the fact that they're doing it at all. Preferably including a lengthy technical description about why it's a terrible idea and breaks the internet.
I'm sure the script-reader in Comcast's "support" will be enamored at your "lengthy technical description."
Most of these people hate their jobs as much as we hate the existence of their positions.
Bottom line: If they're polite and helpful, I think it's being a bit of a jackass to annoy them and waste their time. If they're snippy and rude (commonly are, unfortunately) then it's fair game. :)
Re: (Score:3, Funny)
The opt-out is pretty easy, and I've also sent an email to comcast regarding this.
Hello lothos,
We received your email regarding the easy opt-out, and we would like to take the time to assure you that we are doing everything in our power to make this much more difficult. We apologize for any conveniance you may have encountered, and thank you for being a valued Comcast customer!
Best Regards,
Comcast Support
Re: (Score:2)
Interesting. That wasn't the case last time this story ran.
fucking idiots.....at least I have BIND (Score:5, Informative)
I've always used a linux box as my firewall /router box at home, and I've been running BIND as a caching DNS server. Fortunately this won't affect me, as I totally bypass spamcast's bullshit.
Comment removed (Score:4, Interesting)
Re:The flip side of net neutrality (Score:4, Informative)
No new legislation is needed. Just get the courts involved.
Exactly. This act is already illegal. It is called typo-squatting.
http://thomas.loc.gov/cgi-bin/query/z?c106:S.1255.IS:= [loc.gov]
Specifically, see section 3, (2)(a), and probably (2)(b) as well.
Now we just need as many people as we can get, whom have a domain name which is trademarked, to press charges against comcast under this law for your own domain.
`(i) an award of statutory damages in the amount of--
`(I) not less than $1,000 or more than $100,000 per trademark per identifier, as the court considers just; or
`(II) if the court finds that the registration or use of the registered trademark as an identifier was willful, not less than $3,000 or more than $300,000 per trademark per identifier, as the court considers just; and
`(ii) full costs and reasonable attorney's fees.
Chances are since the main purpose of this change is for ad revenue, and not a willful infringement, only line (I) will apply.
Additionally, you probably can't get the 'bad faith' additions applied, unless you can somehow prove the ads served on their 'page not found' fake-page happen to be ads for your competition.
But a minimum of $1000 plus attorney fee's is pretty decent if you have nothing better to do...
Whats this? (Score:2)
Huh, the link keeps going to something about net neutering. Oh well.
Method? (Score:2)
I ask because if they're redirecting all port 53 traffic, using your own servers (or anyone else's) won't do you much good. Also, it's legality is questionable.
Re: (Score:3, Informative)
"Accidently" Hacking their Server (Score:5, Interesting)
So if you are trying to pen test some machines you own and Comcast points you to their server who is to blame? Are you really responsible if Comcast hijacks your DNS requests and sends you to their server?
I was testing against a known invalid DNS entry (ie: personally owned but not parked domain name). How are you responsible when they hijack your connection?
Even better is when someone pwns Comcast's server and and exploits all of Comcast's customers with a browser exploit hosted there.
Run your own (Score:2)
At least Comcast is using MAC addresses (Score:2)
At least Comcast got the opt-out implementation right. It's done by the cable modem's MAC address, which means that all DNS lookup traffic will start getting NXDOMAIN queries. Oddly, their instructions indicate that this only takes effect when your modem does its next DHCP client lease. My guess is they've blocked off a range of IPs as "opt out," and just assign your MAC to get a lease from the out out range.
I'd greatly prefer it if Comcast had just left things alone, of course; at least, though, they di
comcast sponsors standards work on this topic (Score:4, Informative)
http://tools.ietf.org/html/draft-livingood-dns-redirect-00
note where author works.
Intentional and Malicious Obfuscation (Score:2, Informative)
Optimum Online in NY also started recently (Score:3, Informative)
They've got about 3 million subscribers in the NY metro area (CT, NJ and NY excluding Manhattan). They just started doing this a couple of months ago. I noticed it when my DNS queries started failing completely. Seems I had changed my DNS servers to ones not owned by Optimum (aka Cablevision) because of speed issues, and with their most recent change they're also blocking DNS queries directed to servers other than their own.
Don't look for the latest net neutrality bill to fix this. All that is is the ISPs making the bag of bribes bigger until the greed of Congress can no longer resist.
It still takes 2 days to opt-out. (Score:5, Funny)
Your opt-out request has been confirmed. We will complete processing of this request within 2 business days.
I wonder if /.ing the Comcast request page makes it take longer. ;-)
Re:It still takes 2 days to opt-out. (Score:4, Informative)
The latency comes from two factors.
The biggest is because Comcast gives very long DHCP leases, and the change doesn't propagate to your system until your access device gets a new DHCP lease.
The second is they probably batch updates to the DHCP server to say who's opted-out.
If you want to have it go faster, after going to the opt-out site, reset your cable modem and your NAT box and it will probably take effect right away. If that doesn't work, wait an hour and try again.
1-800-comcast (Score:2)
If you have about ten minutes be sure to give them a call. Explain to them that they're breaking basic internet functionality, the very service you're paying for.
No ISP should ever supply bogus dns info for domains they don't own.
Dupe (Score:2)
http://yro.slashdot.org/article.pl?sid=09/07/09/1811249 [slashdot.org]
Cox opt out (Score:2, Insightful)
Opted out a while ago. (Score:2)
Worked fine, I get the proper NXDOMAIN response. No goofy fake 'domain not found' page, like bellca.
WTF?!? Yesterday I was getting NXDOMAIN correctly, today I'm back on to their crappy search page! Dammit, I opted out when they first announced this! Comcast, you bastards!
Comcast (Score:2)
Comcast's version is orders of magitude better... (Score:5, Informative)
Comcast's version is an order of magnitude better than everybody else's.
a: There is a REAL opt-out, that puts your DHCP lease to point to a DNS resolver that doesn't do this. I'll have to do this when I get home. Compare this with, eg, Verizon's pitiful opt-out instructions involving manually changing DNS settings [verizon.net].
b: IF you had manually set your DNS resolver to a Comcast server, you are unaffected (they added new resolver addresses to do this), per previous discussions by the Comcast folks over at Broadband Reports.
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
I don't like NXDOMAIN wildcarding (it was one of the motivations behind building the ICSI Netalyzr), but if an ISP is going to do it, Comcast's is actually well constructed to both limit collateral damage (it only gets www.*) and be able to be bypassed with a real opt-out.
Re: (Score:3, Interesting)
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
You can run more than just web sites on a www. domain.
Re:Comcast's version is orders of magitude better. (Score:4, Informative)
Yes, but it's poor practice to advertise anything but a webserver through a www.* IP name. If the host is doing something else, it should have another IP name for people accessing that function. Among other things, it makes it much easier to move that function off that machine without touching the webserver. www.* could affect things other than webservers, but it shouldn't, and mostly, it won't. That doesn't make what Comcast is doing *right*, but it does make it slightly less horribly awful. Slightly.
Re: (Score:3, Informative)
Here are my tests:
www.blahblahblahblahblah.com
Bogus redirect page.
www.blahblahblahblahblah
NX
blahblahblahblahblah.com
NX
www.blahblahblahblahblah.ner
NX
Eventually all failed non-existant domains that are queried through Comcast's servers, where the query begins with www., will get redirected. They just haven't phased that in, yet: DomainHelperLogic [comcast.net]:
We will eventually phase in the following pattern matches to enhance this service in the future:
(1) www.SOME-INVALID-NAME.cmm or
(2) www.SOME-INVALID-NAME
- The entry must include "www" followed by a dot ("www.")
...
Old news (Score:2)
WTF, this is old news! There's even a link to the month-old story in the "related stories" box below the summary. Why is Slashdot posting a freakout story that makes it sound like it just came out of nowhere all of a sudden?
Comcast isn't the only one (Score:2)
Qwest (DSL) is doing this too. I knew there was something about it that annoyed me, but I hadn't given it much thought until now, when I can totally see why this is a BAD THING.
there are two sides to this coin (Score:5, Interesting)
The other side of the coin is the customer experience. Think about the average internet user. They cannot tell the difference between a 404 error and a 504 error.
People often unknowingly mistype URLs and automatically believe that their internet is broken and they need to call their ISP in order to get it working again. My personal experience working tech support for a large ISP is that mistyping domain names is a huge call driver, and this service is meant to address that.
That's the other side, now flame on.
Hold the phone - it's bad, but not that bad (Score:5, Interesting)
Look at the DomainHelperLogic [comcast.net] and the only thing it hijacks are DNS lookups that begin with www and end with a valid TLD (.com, a ccTLD like .us, etc.).
While I think this still stinks that they are hijacking DNS at all, and as a Comcast customer I will complain and opt-out, I think they're doing it in a fairly logical way.
But it's not that bad. If you do a DNS lookup for any domain (say for an MX or NS record) you're never going to see this. Your lookups will only be affected if the query starts with www, followed by a domain, ending with a valid TLD (.com, a CC, etc.).
If your internal office uses something such as mycompany.internal, then even a www.mycompany.internal query isn't going to get hijacked since .internal isn't a valid TLD. If you are using mycompany.com for internal use, you should own mycompany.com externally, and negative replies will still work and not get hijacked.
Again, while I oppose monkeying with DNS, this appears to be fairly well thought out and not anywhere near as bad as most other implementations.
Does Comcast intercept all DNS requests? (Score:3, Interesting)
My main question would be: Does Comcast intercept and answer all DNS requests on its wires?
My reason for asking is that I've generally found that it's not a very good idea to use the ISP's nameservers. They never work very well, in my experience. When I've been responsible for such things, I've generally looked for a few good nameservers that are (electronically) nearby, and tell my machines to use them. I usually get faster and more accurate DNS resolution that way.
But if the ISP is looking specifically for any DNS requests, ignoring their destination address, and forging an answer that points to their own machine, then the above strategy won't work.
Yes, forging replies to packets not addressed to you is a nasty thing to do. Comcast has been caught red-handed doing this, e.g. to tell both ends of a P2P connection that the other has closed the connection. So it seems likely that they may be doing the same thing here. But I can't quite tell from what I've read.
Re: (Score:2)
It was down three weeks ago when the story ran the first time. It eventually came back up.
Re:Opt-out page down already? (Score:5, Interesting)
Which, if true, makes the opt-out process even more ludicrous. If I'm at home opting out, shouldn't they just DETECT my mac address, and do the opt-out automatically?
Instead, I had to enter my mac address manually (along with my e-mail address) - and then they told me it would take two business days to go through. (Granted, I got a confirmation e-mail the next day saying it was done, but why isn't this automated?)
Re: (Score:3, Informative)
I guessing that when you opt-out, you give them your MAC so that they can assign you to a different IP address pool. Then they just decide if you get hijacked or no
Re: (Score:2)
AFAIK, it's not possible for a cable ISP to simply "detect" your MAC address. They probably log the IPs assigned to MACs for auditing/subpoena purposes, but this isn't some simple ip2mac() thing they can call.
As for the delay in processing your opt-out- I imagine the database/configuration isn't written on-the-fly as people submit requests, but is handled in batch jobs in off-peak times like most everything else in legacy systems.
Re: (Score:3, Informative)
They know which MAC address currently has the lease for which IP address, and they know which customer owns which MAC address. They also know which IP addresses belong to them, so they can separate "people opting out from home" from "people trying to opt out from work".
Therefore, it could (in theory) be automated.
Re: (Score:2)
This long? Slashdot ran this story weeks ago.
Not OpenDNS (Score:3, Insightful)
4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6
At least this story doesn't have OpenDNS in the "from the X department" this time.
OpenDNS does exactly the same thing, so you might as well stick with your comcast servers.
Re: (Score:2)
You're actually trying to claim that OpenDNS's bounce pages are as bad as Comcast's?
Who gives a shit about the bounce pages? My concern is that the lack of a proper NXDOMAIN response will break various applications whose authors were foolish enough to think that the RFCs would be followed. In that respect OpenDNS is no better.
I'm glad I have the knowledge and ability to run my own DNS server and don't have to deal with this bullshit.
WTF? (Score:3, Insightful)
There shouldn't be any hijack page, simple as that.
And yes, you can register an account for OpenDNS. But why would anybody here be advocating standards-breaking, overcomplicated, web-based nonsense?
There is nothing wrong with Treewalk, which is why I didn't mention it.
Re: (Score:2, Informative)
Re: (Score:3, Informative)
They do the same thing.... unless you register an account. Why do people always leave that part out?
Re: (Score:2, Interesting)
Re: (Score:2)
You have to either register your IP address on the account, or use their dynamic-update client.
I haven't used OpenDNS for several months (since I left my previous employer). It's possible that they've changed it, but I see no reason they would have. We got proper NXDOMAIN responses from OpenDNS.
Re: (Score:2)
Because then they sell your data and that only works if you happen to be logged in at the time, something that will probably become an issue if you use a laptop for instance.
If you're willing to put up with that crap then fine, but it's not a valid fix for DNS hijacking.
Re: (Score:2)
You don't have to be logged in... my previous employer had it set up. NXDOMAIN responses worked properly, and nobody had to log in to anything.
You do have to register your IP address on your account (or use the dynamic-update client).
Re: (Score:2)
Re:Treewalk or OpenDNS (Score:5, Informative)
HOLY FUCKING SHIT
STOP SUGGESTING OPENDNS, THEY DO THIS SHIT TOO.
Excuse my while I go blow a bloodvessel. Every single time a story like this comes up some idiot suggests OpenDNS and idiot mods initially mod them up.
I'd link where this happened last time but for the life of me I can't figure out how to view more than my several dozen posts.
Re: (Score:2)
Don't worry. I've got it for you right here. [slashdot.org] Make sure you notify your next of kin before clicking thru.
Re:Treewalk or OpenDNS (Score:5, Insightful)
DNS hijacking isn't evil because the companies that do it is evil. It's evil because it breaks standards, and therefore breaks all sorts of other crap.
It doesn't matter what company does it, it's still fucked up. To suggest that OpenDNS breaking standards is any better than Comcast breaking standards is just plain stupid and clearly missing the point entirely.
Re:Treewalk or OpenDNS (Score:5, Interesting)
Because after all, if I don't use their DNS, why should I care where they are directing non-existant domain traffic to?
Using OpenDNS, Treewalk, ns1.sprintlink.net, etc doesn't matter because a) Returning the A record when the domain does not exist blatantly violates the RFCs: the established commonly agreed upon standards without which the internet would cease to function and b) some ISPs redirect your DNS traffic to their servers whether you like it or not. Some outright block DNS servers that don't belong to them, and others silently redirect your requests. c) In the README file of your latest application, you shouldn't have to tell everyone that they need to use your DNS servers just to get a *correct* response.
It isn't just you at home with your pr0n that has to deal with this BS. I have to deal with it where I work, because my company's ISP is a cable provider who does this redirect crap. So when I go to write an app that *might* use DNS, I have to screw with this nonsense because the cableco can't be bothered to return an NX - but instead always returns an A record for their server - subject to change without notification. So when they change to redirect to another server, wtf am I supposed to do then? The only way my app could possibly tell there was a problem is to see if the response matches this redirect server. And no, it isn't an option for my application to just willy nilly pick a DNS server of its choice to use. My application requests a lookup from the OS's network layer, but has no particular knowledge of the DNS servers - exactly how it is supposed to be.
If I give my app to other people, are they supposed to put into the app's configuration the A record information that would correspond to their particular ISP's "redirect" host? My app needs to know when the DNS lookup failed. I have no way to tell when every damn name returns an A record. I count on the DNS server to respond in the way the RFCs set out. Comcast and the other ISPs are saying "fuck your rules"
As has been said until we're blue in the face:The internet is not the web. If the ISPs and the browser folks want to sit down and see what the RFC permits and figure out how to return a url in the NX that the browser would recognize and could handle, then I have no problem with that. As long as it doesn't interfere with the normal operation of an NX response. As I'm sitting here thinking about it, the place for this information seems to be either in the DHCP lease, or in the wpad.dat auto-proxy configuration file. But Comcast and the others like them have decided they don't have to play well with others.
Re: (Score:2)
If a DNS query resolves, it resolves. Are you sure you just weren't getting a non-response from the packets being sent out? The resolver sits beneath any particular software doing host name lookups, so whether it's a ping, a browser, a mail client or whatever, it would still be the same resolver asking the Comcast DNS servers.
Re: (Score:3, Informative)
I just looked at my cablemodem and it has 4 MAC addresses associated with it:
HFC MAC Address
Ethernet MAC Address (probably not?!)
CM USB MAC Address
CPE USB MAC Address
I suspect that it is the first?
No sense entering it until I know if it makes a difference or just allows the scam to go on.
Thanks!
HFC is the one associated in DOCSIS, so 99% sure it's that one. And you're welcome.