Slashdot Mirror
Comcast the Latest ISP To Try DNS Hijacking
A semi-anonymous reader writes "In the latest blow to DNS neutrality, Comcast is starting to redirect users to an ad-laden holding page when they try to connect to nonexistent domains. I have just received an email from them to that effect, tried it, and lo and behold, indeed there is the ugly DNS hijack page. The good news is that the opt-out is a more sensible registration based on cable modem MAC, rather than the deplorable 'cookie method' we just saw from Bell Canada. All you Comcast customers and friends of Comcast customers who want to get out of this, go here to opt out. Is there anything that can be done to stop (and reverse) this DNS breakage trend that the ISPs seem to be latching onto lately? Maybe the latest net neutrality bill will help." Update: 08/05 20:03 GMT by T : Here's a page from Comcast with (scant) details on the web-jacking program, which says that yesterday marked the national rollout.
I'm not an expert on DNS. Can someone explain to me, as simply as possible, why this is a bad thing? I understand that it's a pain to be redirected to some random ad-laden piss-poor search page, but what will this break?
This is not a troll or flamebait, I genuinely want some education.
All intents and purposes. Not intensive purposes.
Is it just me or was this story on slashdot like three weeks ago? And I complained then? And we all opted out?
I noticed this yesterday, and they only seem to hijack www.example.com, and not example.com or ftp.example.com.
Still a pain in the ass, and I'm in the process of opting-out. The opt-out is pretty easy, and I've also sent an email to comcast regarding this.
Hosting and Domain name coupons
Which, if true, makes the opt-out process even more ludicrous. If I'm at home opting out, shouldn't they just DETECT my mac address, and do the opt-out automatically?
Instead, I had to enter my mac address manually (along with my e-mail address) - and then they told me it would take two business days to go through. (Granted, I got a confirmation e-mail the next day saying it was done, but why isn't this automated?)
4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6
At least this story doesn't have OpenDNS in the "from the X department" this time.
OpenDNS does exactly the same thing, so you might as well stick with your comcast servers.
I've always used a linux box as my firewall /router box at home, and I've been running BIND as a caching DNS server. Fortunately this won't affect me, as I totally bypass spamcast's bullshit.
Lawyers, MBA's, RIAA? A jedi fears not these things!
No new legislation is needed. Just get the courts involved. Let content providers sue the heck out of Comcast for making a dime off of abusing their domain names. The ISPs think that Google, etc. are "using their pipes to make money," well this is using the content provider's domain and brand to make money. Technical details aside, the effect on the relationship between the content provider and their users is the same whether it is literally hijacking control over the subdomains or creating the perception to user that that is happening. No matter what Comcast may claim, they are altering the relationship between the domain holders and their users.
OpenDNS is not a solution. They do the same thing.
They do the same thing.... unless you register an account. Why do people always leave that part out?
So if you are trying to pen test some machines you own and Comcast points you to their server who is to blame? Are you really responsible if Comcast hijacks your DNS requests and sends you to their server?
I was testing against a known invalid DNS entry (ie: personally owned but not parked domain name). How are you responsible when they hijack your connection?
Even better is when someone pwns Comcast's server and and exploits all of Comcast's customers with a browser exploit hosted there.
DNS is supposed to tell you (essentially) "no such domain name registered" when you try to find a domain name.
IFF (e.g. if and only if) DNS _only_ serviced web browsers, then one noise-page (my adverts here) is no different than any other noise page (no such name) because a human is going to go "oh, that's not what I was looking for".
But there is a heck of a lot more going on out here in the internet than just web browsing, and significant portions of it hinge on getting true and correct answers from the DNS system.
With DNS boned-up to return false positives on all names, then money can be stolen from you, the causal web browser. For instance, I send you an email from support@bankofamercia.com; you don't notice the transposition of letters, your spam filter looks up bankofamercia.com and the DNS service return as IP address instead of no such address, that address is the same one as I spoofed in the email, the spam filter says its a good email, you get owned.
Okay, that _is_ contrived, so try this instead...
It's 1964. You are at a pay phone. Your car has broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and you get a busy signal, and you get your dime back. You call home again and get help. The system worked.
It's 1964. You are at a pay phone. Your car is broken down. It's your last dime. You call home, but mis-dial a number that doesn't exist and some random person answers and proceeds to try to sell you car wax. Your dime is gone. You are still stuck. The system has failed.
Imagine your life if you _never_ got a busy signal. You call any extension in any company and you get to leave a voice mail but nobody will ever get that message. It would be living hell.
Worse yet, you run a small company, you may a small number of sales each month that are vital to your companies survival. You invest in an expensive advertisement on the superbowl and everything goes great. Then your DNS server dies. Now there is nobody to answer the proper DNS queries. The DNS squatter wakes up and since mylittlecompany.com no longer resolves, all that traffic goes to the Comcast Advertisement Shill page. In just a few minutes you get your DNS server working again, but everyone who got the bogus page thinks your company is trying to sell comcast telephone service and web search services and you never go that business. You are out big cash and your name is ruined. IF the spamvertisement page hadn't been there, those people might instead be thinking "wow, this service is so popular I cannot get in, maybe I'll try back in a bit" instead of "why did comcast decide to take out a superbowl ad that made it look like they sold that interesting little product?"
In short, what if every time your cell phone couldn't be found (because it was off or the battery died etc) the people trying to call you got silently redirected to a random "service" of the type one sees on late night television, offering jokes or sex chat, ostensibly in your good name?
That's what is wrong with doing that.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
http://tools.ietf.org/html/draft-livingood-dns-redirect-00
note where author works.
Your example fails because internalmail.company.com will resolve through company.com, not dnsshill.comcast.com. That is "company.com" is authoritative for "internalmail.company.com" in the hierarchical name service system. The questions of what happens in this case is questionable. Especially since in your split tunnel you probably have prepended company.com's internal DNS resolvers in the name search space so that the VPN user sees the internal sites in preference to the external ones.
Your point is correct, your example is flawed.
IMHO, of course 8-)
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
It depends how integrated the system is. Your mac is only visible in the IP header until your packet hits a router. At that point your MAC gets stripped off and the router's MAC replaces it. I am assuming that your packet would pass through a router before hitting the web page, so it isn't as easy as reading the source address of the packet.
I guessing that when you opt-out, you give them your MAC so that they can assign you to a different IP address pool. Then they just decide if you get hijacked or not based on the source IP address.
Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
I had to jump through hoops to get the hijacking removed from FIOS. There's no way an average user would be able to do it. Verizon's instructions weren't even even accurate, I had to Google to get the right directions that were put up by some bloggers. I'm sure it was all Verizon's intention to keep the direction so cryptic and flat out wrong. Fuck the phone and cable companies and the fuckwad senators and congresspeople that let these sleazebags get away with this shit. I'm so fucking tired of having everything be a battle all the fucking time with these "services". What the fuck ever happened to competition in the US? There's like only 3 companies for any industry. Too big to fail my ass.
They've got about 3 million subscribers in the NY metro area (CT, NJ and NY excluding Manhattan). They just started doing this a couple of months ago. I noticed it when my DNS queries started failing completely. Seems I had changed my DNS servers to ones not owned by Optimum (aka Cablevision) because of speed issues, and with their most recent change they're also blocking DNS queries directed to servers other than their own.
Don't look for the latest net neutrality bill to fix this. All that is is the ISPs making the bag of bribes bigger until the greed of Congress can no longer resist.
Your opt-out request has been confirmed. We will complete processing of this request within 2 business days.
I wonder if /.ing the Comcast request page makes it take longer. ;-)
If you have about ten minutes be sure to give them a call. Explain to them that they're breaking basic internet functionality, the very service you're paying for.
No ISP should ever supply bogus dns info for domains they don't own.
Everything that I've seen on the OpenDNS website is to the contrary, (and I have an account.) Care to share the secret?
There shouldn't be any hijack page, simple as that.
And yes, you can register an account for OpenDNS. But why would anybody here be advocating standards-breaking, overcomplicated, web-based nonsense?
There is nothing wrong with Treewalk, which is why I didn't mention it.
HOLY FUCKING SHIT
STOP SUGGESTING OPENDNS, THEY DO THIS SHIT TOO.
Excuse my while I go blow a bloodvessel. Every single time a story like this comes up some idiot suggests OpenDNS and idiot mods initially mod them up.
I'd link where this happened last time but for the life of me I can't figure out how to view more than my several dozen posts.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
My ISP Cox did this and to opt out of it all you had to do was change your DNS server to another one that they provided. In my opinion this is much better than cookies and router MAC addresses because you can do it on a computer by computer basis.
Because after all, if I don't use their DNS, why should I care where they are directing non-existant domain traffic to?
Using OpenDNS, Treewalk, ns1.sprintlink.net, etc doesn't matter because a) Returning the A record when the domain does not exist blatantly violates the RFCs: the established commonly agreed upon standards without which the internet would cease to function and b) some ISPs redirect your DNS traffic to their servers whether you like it or not. Some outright block DNS servers that don't belong to them, and others silently redirect your requests. c) In the README file of your latest application, you shouldn't have to tell everyone that they need to use your DNS servers just to get a *correct* response.
It isn't just you at home with your pr0n that has to deal with this BS. I have to deal with it where I work, because my company's ISP is a cable provider who does this redirect crap. So when I go to write an app that *might* use DNS, I have to screw with this nonsense because the cableco can't be bothered to return an NX - but instead always returns an A record for their server - subject to change without notification. So when they change to redirect to another server, wtf am I supposed to do then? The only way my app could possibly tell there was a problem is to see if the response matches this redirect server. And no, it isn't an option for my application to just willy nilly pick a DNS server of its choice to use. My application requests a lookup from the OS's network layer, but has no particular knowledge of the DNS servers - exactly how it is supposed to be.
If I give my app to other people, are they supposed to put into the app's configuration the A record information that would correspond to their particular ISP's "redirect" host? My app needs to know when the DNS lookup failed. I have no way to tell when every damn name returns an A record. I count on the DNS server to respond in the way the RFCs set out. Comcast and the other ISPs are saying "fuck your rules"
As has been said until we're blue in the face:The internet is not the web. If the ISPs and the browser folks want to sit down and see what the RFC permits and figure out how to return a url in the NX that the browser would recognize and could handle, then I have no problem with that. As long as it doesn't interfere with the normal operation of an NX response. As I'm sitting here thinking about it, the place for this information seems to be either in the DHCP lease, or in the wpad.dat auto-proxy configuration file. But Comcast and the others like them have decided they don't have to play well with others.
There is very little future in being right when your boss is wrong.
Comcast's version is an order of magnitude better than everybody else's.
a: There is a REAL opt-out, that puts your DHCP lease to point to a DNS resolver that doesn't do this. I'll have to do this when I get home. Compare this with, eg, Verizon's pitiful opt-out instructions involving manually changing DNS settings.
b: IF you had manually set your DNS resolver to a Comcast server, you are unaffected (they added new resolver addresses to do this), per previous discussions by the Comcast folks over at Broadband Reports.
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
I don't like NXDOMAIN wildcarding (it was one of the motivations behind building the ICSI Netalyzr), but if an ISP is going to do it, Comcast's is actually well constructed to both limit collateral damage (it only gets www.*) and be able to be bypassed with a real opt-out.
Test your net with Netalyzr
First off, port 53 is NOT being redirected. Use your choice of port 53 provider - whether your own DNS, Level 3, OpenDNS, whatever. As for how it works, check out http://networkmanagement.comcast.net/DomainHelperLogic.htm and http://tools.ietf.org/html/draft-livingood-dns-redirect-00 for the precise details. The second document is a complete technical description.
DNS hijacking isn't evil because the companies that do it is evil. It's evil because it breaks standards, and therefore breaks all sorts of other crap.
It doesn't matter what company does it, it's still fucked up. To suggest that OpenDNS breaking standards is any better than Comcast breaking standards is just plain stupid and clearly missing the point entirely.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
I just looked at my cablemodem and it has 4 MAC addresses associated with it:
HFC MAC Address
Ethernet MAC Address (probably not?!)
CM USB MAC Address
CPE USB MAC Address
I suspect that it is the first?
No sense entering it until I know if it makes a difference or just allows the scam to go on.
Thanks!
HFC is the one associated in DOCSIS, so 99% sure it's that one. And you're welcome.
They know which MAC address currently has the lease for which IP address, and they know which customer owns which MAC address. They also know which IP addresses belong to them, so they can separate "people opting out from home" from "people trying to opt out from work".
Therefore, it could (in theory) be automated.
c: It does NOT get *.whatever, only www.*.(TLD), thus even when you don't opt out, it is at least limited to web-related typos. This is actually a big deal, as I think Comcast is the first one NOT to do it for everything.
You can run more than just web sites on a www. domain.
Give me Classic Slashdot or give me death!
Yes, but it's poor practice to advertise anything but a webserver through a www.* IP name. If the host is doing something else, it should have another IP name for people accessing that function. Among other things, it makes it much easier to move that function off that machine without touching the webserver. www.* could affect things other than webservers, but it shouldn't, and mostly, it won't. That doesn't make what Comcast is doing *right*, but it does make it slightly less horribly awful. Slightly.
Dnsmasq has an option to "fix" this kind of dns redirection called bogus-nxdomain. The bogus ip address to block is 208.68.139.38. I wonder if comcast uses multiple addresses or will ever change it...
Maybe I'll just switch to using 4.2.2.[1-6] as many other people have mentioned.
The other side of the coin is the customer experience. Think about the average internet user. They cannot tell the difference between a 404 error and a 504 error.
People often unknowingly mistype URLs and automatically believe that their internet is broken and they need to call their ISP in order to get it working again. My personal experience working tech support for a large ISP is that mistyping domain names is a huge call driver, and this service is meant to address that.
That's the other side, now flame on.
My comments here are my own; I do not speak for my employer.
Look at the DomainHelperLogic and the only thing it hijacks are DNS lookups that begin with www and end with a valid TLD (.com, a ccTLD like .us, etc.).
While I think this still stinks that they are hijacking DNS at all, and as a Comcast customer I will complain and opt-out, I think they're doing it in a fairly logical way.
But it's not that bad. If you do a DNS lookup for any domain (say for an MX or NS record) you're never going to see this. Your lookups will only be affected if the query starts with www, followed by a domain, ending with a valid TLD (.com, a CC, etc.).
If your internal office uses something such as mycompany.internal, then even a www.mycompany.internal query isn't going to get hijacked since .internal isn't a valid TLD. If you are using mycompany.com for internal use, you should own mycompany.com externally, and negative replies will still work and not get hijacked.
Again, while I oppose monkeying with DNS, this appears to be fairly well thought out and not anywhere near as bad as most other implementations.
The misappropriation is technically bad because it's done at the wrong protocol layer, and even when it works it's bad because it'll cause your browser to do something you didn't want.
Here's how DNS is supposed to work when it works, and how it's supposed to work when the lookup fails.
Now look at what happens if your DNS server lies to your application by giving it some other IP address instead of the correct failure message, like 68.87.60.144.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Here are my tests:
www.blahblahblahblahblah.com
Bogus redirect page.
www.blahblahblahblahblah
NX
blahblahblahblahblah.com
NX
www.blahblahblahblahblah.ner
NX
Eventually all failed non-existant domains that are queried through Comcast's servers, where the query begins with www., will get redirected. They just haven't phased that in, yet: DomainHelperLogic:
We will eventually phase in the following pattern matches to enhance this service in the future:
(1) www.SOME-INVALID-NAME.cmm or
(2) www.SOME-INVALID-NAME
- The entry must include "www" followed by a dot ("www.")
...
My main question would be: Does Comcast intercept and answer all DNS requests on its wires?
My reason for asking is that I've generally found that it's not a very good idea to use the ISP's nameservers. They never work very well, in my experience. When I've been responsible for such things, I've generally looked for a few good nameservers that are (electronically) nearby, and tell my machines to use them. I usually get faster and more accurate DNS resolution that way.
But if the ISP is looking specifically for any DNS requests, ignoring their destination address, and forging an answer that points to their own machine, then the above strategy won't work.
Yes, forging replies to packets not addressed to you is a nasty thing to do. Comcast has been caught red-handed doing this, e.g. to tell both ends of a P2P connection that the other has closed the connection. So it seems likely that they may be doing the same thing here. But I can't quite tell from what I've read.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.