So my ISP was hijacking my DNS

<- Back

So my ISP was hijacking my DNS

frostbyte7

Comments (117)

simonjgreen
Noting this article skips over any discussion about why, or potentially (in the eyes of the law at least) legitimate reason an ISP might do this.Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.I am speaking here as the owner of a UK ISP (who does not currently do this).
jwrallie
My workplace is messing with DNS as well, probably to filter specific websites, and I would not mind it since for the context of my usage that is perfectly fair.But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.I have no idea how my coworkers seem to be so insensitive to it.
nunez
AT&T in the US does this. Traditionally they did this so that failed lookups were routed to their search engine, which of course fed users ads.
Terr_
I fear a future where pretty much everything is trying to hack you or doing something which is indistinguishable from the meddling of a hostile actor.I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.
temp0826
Recently went down a little rabbit hole to get my house in order when I noticed weird things showing up at https://dnscheck.tools/ . (I don't really understand how these checks work though)
daitangio
Telecom Italia locks my DNS server (I cannot change it).I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.The trick is simple: disable DHCP on your router, and activate it on PIHole. As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.
maeln
For various reason, I also setup an Unbound who proxy to quad9 and is only accessible through DNS over HTTPS/QUIC and is behind a reverse proxy with auth (because being an open dns resolver on the internet is still a bad idea). This is nice because I can then have a dnsproxy or similar on my various devices, who all point to it and be pretty sure nothing can hijack my DNS queries. I also come with the benefit of forcing thing like a minimum TTL to avoid dumb services who decide to put a 10 seconds TTL to all their DNS entry...
jfyi
Hardly a new thing.Oh and btw, it's not "DNS Hijacking" it's a "Domain Helper", see: https://feross.org/shame-on-you-comcast/
eqvinox
The point of running a local unbound is indeed to turn on DNSsec validation. After that, it's the domains' fault for not using DNSsec. But at least your own stuff won't be tampered with, because you use DNSsec on your own domains, right? Right?:-(Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).
AceJohnny2
Which ISP was doing this? It's worth calling out the bad actors.
aand16
How is this not illegal... isn't what the ISP doing "hacking"?
itopaloglu83
I’m using NextDNS over https and frequently experience connection freezes with both Spectrum and T-Mobile. I don’t know what they’re trying to do, but I’m not happy with the way they’re trying to block basic services.
unethical_ban
Here is my self-documentation for home DNS setup: https://docs.zeropolis.net/doku.php/tech:homednsUnlike OP, I have all my DNS route completely to my home DNS server, and only make changes to that container and my VM host during a "change window" meaning not during work hours. I block port 53 outbound entirely and have host entries for the two domains that my DNS server uses for DoH. If I had a better firewall on the edge, I would leave 53 open for my DNS container, but this workaround seems suitable enough for the home network.
j45
It's best to treat your ISP's DNS as not being in your best interest, and actively against you getting your full internet speed and responsiveness.Set an external DNS server on your router, or learn to run your own locally.
arcfour
> Although your regular internet traffic is encrypted with TLS, your ISP can see the hostname during the TLS handshake (SNI).https://support.mozilla.org/en-US/kb/understand-encrypted-cl... not anymore, with many (not all) sites.
mgoetzke
Deutsche Telekom did that too on my DSL line once, took some arguing to them suddenly 'do nothing' but it suddenly 'worked'
Sha1rholder
Sounds familiar to a Chinese
amstan
Reminds me of the Xfinity "Your personalized WiFi summary" emails. Despite returning their router, using a third party almost-layer-2 modem, my own openwrt router (with its own wifi, thank you very much), their emails seem spooky.They have a counter of all of my devices, somehow (i mean... i guess their count is wrong, but it's infuriating that they try to keep track).
tripdout
We need root DNS servers that support DoH/DoT.
mariofdistrust
my mobile network carrier blocks quad9
ck2
ISP can still see exit IP unless you VPNCloudflare Warp is handy, complete tunnel even if not as private as real VPNsince 80% of the web is on cloudflare it accidentally makes it faster anywayand you don't have to use the cloudflare client, you can use Wireguard
Tepix
Why not start by1. contact the ISP and ask wtf they are doing2. switch ISPs
netsharc
Yum, screenshots of terminal windows, which is just text...Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!
bradknowles
Another reason to use a VPN you can trust, across your entire network and at all times.
z3t4
The story ended before it even started... What are the machine with the wrong IP doing? Is it just forwarding the request, or what is happening?