Noting this article skips over any discussion about why, or potentially (in the eyes of the law at least) legitimate reason an ISP might do this.
Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.
And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.
I am speaking here as the owner of a UK ISP (who does not currently do this).
Geezus_42 2 minutes ago [-]
I'm pretty confident ISPs do want hijack DNS since they've been doing it for decades in order to push ads to their customers.
saidnooneever 5 minutes ago [-]
this is valid, in NL most DNS is also heavy monitored and intercepted to do blocks if mandated etc. if you want to get around it u can tunnel ur tlsdns thingy to another place and they essentially cannot intercept it, they can still block the IPs it resolves to so its hit and miss depending on how the other end is implemented.
its usually not nefarious, that is just the simpelest (and usually, not always) wrong explanation.
people who think this is not normal probarbly didnt experience what kind of shit u could find on the pre google pre monitored internet. for sure shit u do not want your kids to find. if u dont understand, then likely u dont have kids and very weird fetishes...
NordStreamYacht 3 hours ago [-]
She was looking up a torrent site which specialises in porn.
I'm guessing that's the reason.
numpad0 5 minutes ago [-]
[delayed]
neuroticnews25 16 minutes ago [-]
Why she? Karthikey is a male name and the youtube streams show a male face. (Of course it's just a weak signal that can be overriden with an autor's declaration!)
RockRobotRock 1 hours ago [-]
That is incorrect. It's a generic torrent site.
vasco 2 hours ago [-]
What's wrong with downloading porn?
figmert 2 hours ago [-]
Could be that porn is banned, or could but that the problem is the torrent side, not the porn side.
2 hours ago [-]
witnessme 3 hours ago [-]
Why do you assume the others have same ethical compass as you? I hope everyone has the same compass but we have seen again and again trust being broken.
daitangio 3 hours ago [-]
Telecom Italia locks my DNS server (I cannot change it).
I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.
The trick is simple: disable DHCP on your router, and activate it on PIHole.
As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.
noselasd 1 hours ago [-]
Note that there are ISPs that actively hijack traffic to UDP port 53 further inside their network and transparently maps that onto their internal DNS servers.
jachee 41 minutes ago [-]
This is why you would want to setup DNS-over-TLS or DNS-over-HTTPS to, say, 1.1.1.1. They can’t hijack DNS traffic that looks like HTTPS traffic.
someguyornotidk 1 hours ago [-]
And if you can't disable DHCP or set the router in bridge mode, you can just add another router (that you control) between your ISP device and the rest of your network. I've been running this setup for over a decade and didn't run into any noteworthy issues. Leave the ISP-infested router outside your network.
Terr_ 4 hours ago [-]
I fear a future where pretty much everything is trying to hack you or doing something which is indistinguishable from the meddling of a hostile actor.
I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.
Yevini 2 minutes ago [-]
I'm not sure regulation alone would solve it. Depending on the country, governments themselves sometimes require ISPs to interfere with DNS
jwrallie 4 hours ago [-]
My workplace is messing with DNS as well, probably to filter specific websites, and I would not mind it since for the context of my usage that is perfectly fair.
But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.
I have no idea how my coworkers seem to be so insensitive to it.
pbhjpbhj 51 minutes ago [-]
Enabling DoH on a locked down workplace network sounds like a way to get fired.
But I guess that if they let you do it they're probably not competent enough to catch you.
Yevini 35 seconds ago [-]
[dead]
itopaloglu83 18 minutes ago [-]
I’m using NextDNS over https and frequently experience connection freezes with both Spectrum and T-Mobile. I don’t know what they’re trying to do, but I’m not happy with the way they’re trying to block basic services.
mgoetzke 33 minutes ago [-]
Deutsche Telekom did that too on my DSL line once, took some arguing to them suddenly 'do nothing' but it suddenly 'worked'
eqvinox 8 hours ago [-]
The point of running a local unbound is indeed to turn on DNSsec validation. After that, it's the domains' fault for not using DNSsec. But at least your own stuff won't be tampered with, because you use DNSsec on your own domains, right? Right?
:-(
Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).
> In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol.
is true, then I'm ... pretty unsold on its usefulness. Anyone wanna ELI5 whether that's untrue or anything's changed in the last decade?
eqvinox 2 minutes ago [-]
Note the linked post is from 2015. But also:
> domain-validated certificates remain insecure
...99% of the internet runs on DV certificates; that's what ACME & Let's Encrypt are at the end of the day.
jeroenhd 1 hours ago [-]
DNSSEC as designed is pretty useless. It was designed in an era where computers could not be relied upon to do cryptographic validation of something like DNS records, so that duty was delegated to DNS servers like the ones ISPs ran, where records could be cached.
There are also potential downsides (like someone being able to enumerate your subdomains, if you care about such a thing) and it's often switched off by default on operating systems consumers use.
However, it's the only thing that validates DNS records at this moment. That alone makes it worth enabling, in my opinion. For many domain owners, you only need to tick the checkbox in your registrar's domain control pane. If you use a modern DNS server, it's also one config flag and maybe copy/pasting a handful of fields away.
I'll gladly turn off DNSSEC the moment we come up with something better. DoT/DoH doesn't solve the same problem and no real solutions seem to have been proposed. That said, modernisation efforts are still being done. Smaller keys and modern cryptography rather than the massive RSA ones for instance.
usr1106 4 hours ago [-]
I can't speak about the strength or weaknesses of the whole concept.
Out of curiosity I enabled DNSSEC checking beginning this year. I mostly noted nothing in my browsing. However, with 2 services I noted obscure problems that worked only partially. Some Jira plugins and Swedish railway SJ. I needed to excempt some of their domains from being checked to use their services. Of course you waste a couple of hours every time it happens because you don't think of DNSEC first when some web-based services behaves weirdly. There might be more requests not served to my browser, but I just never noticed or bothered to debug.
So not fit for general use. And even as an experienced developer it's not easy to understand why an exception would be needed. A bug in systemd? Incorrect data in DNS? A real attack?
Edit: I don't use standard DNS on port 53 at all. Blocked outgoing requests on that port. Everything DoH or DoT. Of course I need to trust those endpoints at least in repect to confidentiality. And most domains are unsigned. At least for those unsigned ones I need to just trust also in respect to integrity.
jeroenhd 3 hours ago [-]
DNSSEC failures need to be louder. If websites that fucked up their DNSSEC would get the same error messages as websites that fucked up other parts of their security, people wouldn't be so eager to turn off security festures as workarounds.
Give SJ the option to turn off DNSSEC and their website will stay broken. Give people a "someone might be tampering with your connection" popup and they would start caring.
There are also other issues with DNSSEC that need working out, but I still believe it does much more good than it does bad. Leaving everything in the background with an easy-to-disable setting makes it next to useless.
denkmoon 4 hours ago [-]
DNSSEC adoption rate means that this would be insufficient to detect (let alone prevent) that type of tampering for most domains. The correct solution is identified the the first paragraph of the post, which is to use a tamper resistant transport to the dns server (eg DoT, or DoH if you like everything being wrapped in http)
AceJohnny2 4 hours ago [-]
Which ISP was doing this? It's worth calling out the bad actors.
drewfax 4 hours ago [-]
It's pretty much most Indian ISPs and in this case it was ACT Fibernet.
dylan604 4 hours ago [-]
Wouldn't the list of ISPs not doing this be easier to make?
AceJohnny2 4 hours ago [-]
No.
There's a difference between what you're likely referring to, where the ISP's own DNS, which most people are using by default, returning particular results, and what the author is showing here where the ISP is actively tampering with outside DNS responses to insert incorrect responses.
Until now, I was not aware of any ISP doing the latter.
jeroenhd 1 hours ago [-]
Only one ISP I've used ever did this (VodafoneZiggo) and that was over a decade ago, and only to redirect domains that couldn't be found to ad-filled "search" pages.
It's not universal, the occurance or this type of abuse seems to vary wildly from country to country
justauserid 1 hours ago [-]
Want to ISP-less in India? :D At least ACT doesn't blanet throttle/fail uplaods of any sort like Jio does on its 5G – even LLM calls fail.
How is this not illegal... isn't what the ISP doing "hacking"?
noselasd 59 minutes ago [-]
Very few, if any, countries makes this illegal.
Some countries have laws around Net Neutrality or Open Internet that can protect you from this, but even those countries have other legislations that can superseed that in specific cases. (e.g. hijacking DNS can be completely legal for some child protection laws, or to uphold laws that makes some web sites illegal)
figmert 2 hours ago [-]
Illegal, where exactly? In various western countries ISPs are by law required to block some websites. In other countries, ISPs ar eby law required to have escape hatches to be able to shut down the internet. In yet others, everything runs behind a firewall. Take your pick, I guess?
throwawayffffas 2 hours ago [-]
The hijack is probably legally mandated. The site he was trying to reach is a torrent site.
amstan 4 hours ago [-]
Reminds me of the Xfinity "Your personalized WiFi summary" emails. Despite returning their router, using a third party almost-layer-2 modem, my own openwrt router (with its own wifi, thank you very much), their emails seem spooky.
They have a counter of all of my devices, somehow (i mean... i guess their count is wrong, but it's infuriating that they try to keep track).
Tepix 3 hours ago [-]
Why not start by
1. contact the ISP and ask wtf they are doing
2. switch ISPs
esskay 2 hours ago [-]
How do you think that conversation will go? You phone them, get put through to the call center and surprise surprise its not covered by their script.
mgoetzke 32 minutes ago [-]
well after going down a few levels of tech support you do get to someone that 'does nothing' while it the magically works
asdff 2 hours ago [-]
Switching too is funny. You are at the mercy of what isp
ran a line to you. Starlink will fully cooperate with government too. They are a military contractor after all and also at the mercy of musk deciding dumb stuff.
mariofdistrust 22 hours ago [-]
my mobile network carrier blocks quad9
486sx33 11 hours ago [-]
[dead]
Sha1rholder 4 hours ago [-]
Sounds familiar to a Chinese
bradknowles 4 hours ago [-]
Another reason to use a VPN you can trust, across your entire network and at all times.
asdff 2 hours ago [-]
But the isp sits between that no?
throwawayffffas 1 hours ago [-]
All traffic to the VPN is encrypted, including DNS queries.
All your ISP can tell is you are using a VPN.
asdff 17 minutes ago [-]
What about TLS inspection?
ozim 4 hours ago [-]
So a VPN you set up and run yourself.
asdff 2 hours ago [-]
Isn’t that the same as no vpn with extra steps? You are tunneling traffic from a computer you own to a computer you also still own. Third party vpn the whole point is I don’t run it.
khafra 2 hours ago [-]
If you set up a VPN endpoint on a Hetzner box, you're trusting Hetzner not to MITM your DNS queries. They're likely more trustworthy than your local ISP (although that leaves you more identifiable to folks running the servers or snooping on server-side traffic, and Cloudflare will hate you).
That threat model tradeoff is good for many people.
asdff 2 hours ago [-]
Well that wouldn’t be running your own vpn. Hetzner is. They’d let you do this? Seedbox is against their tos hard to imagine they’d be a good choice to run a vpn for your linux isos.
throwawayffffas 1 hours ago [-]
Given the OP use case, you are going to get a letter from Hetzner at some point.
netsharc 2 hours ago [-]
Yum, screenshots of terminal windows, which is just text...
Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!
z3t4 3 hours ago [-]
The story ended before it even started... What are the machine with the wrong IP doing? Is it just forwarding the request, or what is happening?
Rendered at 10:35:44 GMT+0000 (Coordinated Universal Time) with Vercel.
Many ISPs in many countries are forced to do this for certain enforcement action that gets put upon them by their respective states for things such as age gating, censorship, monitoring, it varies state by state.
And to be clear this is in no way an endorsement of the practice, and I am confident no ISP WANTS to do this.
I am speaking here as the owner of a UK ISP (who does not currently do this).
its usually not nefarious, that is just the simpelest (and usually, not always) wrong explanation.
people who think this is not normal probarbly didnt experience what kind of shit u could find on the pre google pre monitored internet. for sure shit u do not want your kids to find. if u dont understand, then likely u dont have kids and very weird fetishes...
I'm guessing that's the reason.
I ended up using PIHole as DHCP, to drive home devices to PIHole, and control my privacy.
The trick is simple: disable DHCP on your router, and activate it on PIHole. As a bonus, PIHole on my RasperryPI2 is way faster than the little chip on my provider Router, and can be patched automatically with unattended upgrades.
I suppose the answer is politics rather than technology: Get enough people together to make a rule against it, and at least it will become niche.
But their DNS responses have latency spikes every couple of minutes of 1-2 seconds that was driving me crazy. I simply enabled DNS over HTTPS in Firefox and everything feels so smooth now.
I have no idea how my coworkers seem to be so insensitive to it.
But I guess that if they let you do it they're probably not competent enough to catch you.
:-(
Coincidentally, a bunch of free wifi stuff blocks the root key queries unbound does at startup, resulting in nothing working until you get those records in there somehow (e.g. load_cache).
> In fact, it does nothing for any of the “last mile” of DNS lookups: the link between software and DNS servers. It’s a server-to-server protocol.
is true, then I'm ... pretty unsold on its usefulness. Anyone wanna ELI5 whether that's untrue or anything's changed in the last decade?
> domain-validated certificates remain insecure
...99% of the internet runs on DV certificates; that's what ACME & Let's Encrypt are at the end of the day.
There are also potential downsides (like someone being able to enumerate your subdomains, if you care about such a thing) and it's often switched off by default on operating systems consumers use.
However, it's the only thing that validates DNS records at this moment. That alone makes it worth enabling, in my opinion. For many domain owners, you only need to tick the checkbox in your registrar's domain control pane. If you use a modern DNS server, it's also one config flag and maybe copy/pasting a handful of fields away.
I'll gladly turn off DNSSEC the moment we come up with something better. DoT/DoH doesn't solve the same problem and no real solutions seem to have been proposed. That said, modernisation efforts are still being done. Smaller keys and modern cryptography rather than the massive RSA ones for instance.
Out of curiosity I enabled DNSSEC checking beginning this year. I mostly noted nothing in my browsing. However, with 2 services I noted obscure problems that worked only partially. Some Jira plugins and Swedish railway SJ. I needed to excempt some of their domains from being checked to use their services. Of course you waste a couple of hours every time it happens because you don't think of DNSEC first when some web-based services behaves weirdly. There might be more requests not served to my browser, but I just never noticed or bothered to debug.
So not fit for general use. And even as an experienced developer it's not easy to understand why an exception would be needed. A bug in systemd? Incorrect data in DNS? A real attack?
Edit: I don't use standard DNS on port 53 at all. Blocked outgoing requests on that port. Everything DoH or DoT. Of course I need to trust those endpoints at least in repect to confidentiality. And most domains are unsigned. At least for those unsigned ones I need to just trust also in respect to integrity.
Give SJ the option to turn off DNSSEC and their website will stay broken. Give people a "someone might be tampering with your connection" popup and they would start caring.
There are also other issues with DNSSEC that need working out, but I still believe it does much more good than it does bad. Leaving everything in the background with an easy-to-disable setting makes it next to useless.
There's a difference between what you're likely referring to, where the ISP's own DNS, which most people are using by default, returning particular results, and what the author is showing here where the ISP is actively tampering with outside DNS responses to insert incorrect responses.
Until now, I was not aware of any ISP doing the latter.
It's not universal, the occurance or this type of abuse seems to vary wildly from country to country
Oh and btw, it's not "DNS Hijacking" it's a "Domain Helper", see: https://feross.org/shame-on-you-comcast/
https://support.mozilla.org/en-US/kb/understand-encrypted-cl... not anymore, with many (not all) sites.
https://divested.dev/misc/ech.txt
Some countries have laws around Net Neutrality or Open Internet that can protect you from this, but even those countries have other legislations that can superseed that in specific cases. (e.g. hijacking DNS can be completely legal for some child protection laws, or to uphold laws that makes some web sites illegal)
They have a counter of all of my devices, somehow (i mean... i guess their count is wrong, but it's infuriating that they try to keep track).
1. contact the ISP and ask wtf they are doing
2. switch ISPs
All your ISP can tell is you are using a VPN.
Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!