Slashdot Mirror
A Look At the Safety of Google Public DNS
darthcamaro writes "Yesterday we discussed Google's launch of its new Public DNS service. Now Metasploit founder and CSO at Rapid7, H D Moore, investigates how well-protected Google's service is against the Kaminsky DNS flaw. Moore has put together a mapping of Google's source port distribution on the Public DNS service. In his view, it looks like the source ports are sufficiently random, even though they are limited to a small range of ports. The InternetNews report on Moore's research concludes: 'What Moore's preliminary research clearly demonstrates to me is that Google really does need to live up to its promise here. Unlike a regular ISP, Google will be subject to more scrutiny (and research) than other DNS providers.'"
8.8.8.8 is almost as easy to remember as 4.2.2.2
It fails miserably, Google revokes it, and we all go back to loving them.
Everyone loves taking a shot at Google, but when they are providing a new FREE service - I can't see it destroying their public image all that much.
I find scientology sexually offensive, you insensitive clod!
My real concern with Google DNS is privacy. Your DNS records are extremely valuable to google, so I sincerely doubt google is not going to record them.
I'm not even entirely convinced about the benefit of using google's; your local DNS server hierarchy is going to be far more responsive, even if it does have a higher miss rate.
Yes, it might be useful for people whose ISP DNS server is slow. That didn't happen to me since my dialup days. Besides, now I simply run my own caching DNS server. It's not hard to set up at all.
I find it amazing that nobody seems to notice that adding an ECHELON and a DCS1000 feed to Google is making it like the NSA, but where people actually VOLUNTEER data. In addition, it's Terms of Service give it more legal freedom to use and abuse your information and intellectual property than even the US border control can with accessing laptops of people entering the country.
It appears 8+ years of indoctrination is paying off big time - nobody appears to remember that privacy is a basic right. All it takes is some BS about "not being evil" for people to miss the shocking depth to which they can access all your personal data. Even the stuff they don't hold themselves will come up through the search engine. By matching up DNS records they will be able to add your entire Internet activity to your identity.
That's going to be fun when you catch some sort of virus downloading porn - and the next time you apply for a job..
Insert
Ahhh... freedom. Finally I can view YouTube from work. That's Google! ...until the network admins block these DNS servers...
Freedom for a day is better than no freedom at all!
I ran some tests against Google DNS and some other DNS providers to measure if Google DNS was actually faster than say OpenDNS, or my local ISP. The results showed OpenDNS completely outperformed Google, but Google did do better than two local ISPs. Read my blog entry about this.
More likely that the FBI is knocking on google's door. It's their job to look into what goes on inside America, and the NSA already got their hands slapped.. so they probably passed on most of the snooping to other agencies.
So I am giving Google DNS a try on my networks.
I do not see the privacy issues, as they are very limited if you are using a cache on your router with Google as the DNS server. Google gets to see one lookup, and then my home router (with dnsmaque) serves any repeat visits for me or the other computers on my network. For the majority of the sites I visit on a regular basis, my router provides the DNS.
I would suspect that a majority of people using home routers have some sort of cache now in the firmware that does similar work, in their OS, or their browser. It is not like Google is able to see me hit their DNS (although I am sure that is true for some users), every time I want to visit a site again. It is of little value, other than in the most general sense of determining what sites are popular.
Living in Chile
Google, Google, who can I turn to? 8.67.53.09
What a fool believes, he sees, no wise man has the power to reason away.
Wonderful!
Think about it. Eventually each of us will have our own DNS entry to identify our individual web presence. The things we make available to do business, social networking etc will be identified through DNS. Why wouldn't Google want to be in on this? Just because there is a profit motive doesn't necessarily mean it is nefarious. This will allow them to add value at a fundamental level. I can see a day when Facebook is irrelevant and people create there own ad-hoc social networks through their own web-presence.
Dan K has been on /., never could cite a single example of an in-the-wild, widespread exploit of the Kaminsky DNS flaw.
Kaminsky Bug == HOGWASH
Yes. A severe security flaw in one of the fundamental layers of the internet is hogwash... because it's not CURRENTLY being widely exploited 'in the wild'.
Please, make sure I never, ever, EVER, hire you to work anywhere near my network.
Reports from my friend inside the GFW, both DNS servers already banned by the Chinese government...wth...and openDNS stayed untouched for like ever...
What percentage of total users use DNS that is not assigned from their ISP? I would guess a good percentage of the /. crowd uses a DNS that is not assigned via their ISP. But out of the total population of internet users, using non-IPS DNS servers has got to be pretty small.
I'm not familiar with all the details behind DNS, but what prevents an ISP from noticing the DNS lookups coming from a user's machine are targeted at the Google DNS IPs, and simply blocking them, or sending the ISP's preferred response instead? Are DNS requests subject to this kind of MITM issue? Again, I don't know much about DNS, so some insight would be appreciated.
Obligatory pedantry:
86.75.30.9
86.75.30.9 would both fit the downbeats better and not require you to write "09" where one would normally see "9".
Seen any botnets using an open DNS service?
Unrestricted access will always be targets of
ruffians.
They redirect to their own pages to make money just like Sitefinder. Everyone called Sitefinder evil, but because they are called "open" people seem to let them get away with this. Google's DNS won't do that at least.
Also, I seem to remember people catching OpenDNS hijacking google.com to inject different ads (again, to make money), and their excuse was that they were "protecting" their customers from Google. If they are doing that now it would be reason alone to not use them. I don't want my DNS responses mangled or filtered and that seems to be getting more common with even legitimate ISPs.
One place which OpenDNS might be better is in privacy. Someone should do a side-by-side comparison of their policies.
"In his view, it looks like the source ports are sufficiently random,
even though they are limited to a small range of ports."
The distribution graph appears to show Google resolver using random ports
between 32768 and 65535. While that's only half the ports available,
it's misleading to characterize it as "a small range of ports".
$ host 8.67.53.09
8.67.53.09 does not exist, try again
I do not see the privacy issues
Having your own DNS cache simply means that Google will only see unique queries from you. Even if your cache never expired any entries, they would still have a record of every single site you visit. They simply wouldn't know how many times you visited.
Do you see the privacy issues now?
From the picture in the article it looks like they have 15 bits of entropy in the port number and 16 bits of entropy in the ID. That's a total of 31 bits of entropy out of 32 theoretically possible. They also add entropy through the case of letters in the domain name itself (and maybe also the lower bits of the IP address, but I haven't verified that). Sounds like this all adds up to 40 or more bits of entropy. With 40 bits of entropy the chance of successful poisoning would be vanishing small.
How do they do the asynchronous updates of entries that are about to expire? If they randomize the timing of those and use TCP rather than UDP they can probably add another 20 bits of entropy right there.
Why waste the CPU cycles & memory on setting up a custom DNS server (especially since they're so potentially vulerable to "DNS poisoning" misdirects & bugs like the Kaminsky bug), when OpenDNS is fast (& they probably implement the same security randomizing features vs. the Kaminsky bug &/or other recursive DNS server DDOS attacks) & works, plus, they respond quickly to "known issues" (such as how they did vs. the Kaminsky bug)?
Between OpenDNS and a good custom HOSTS file, you have all you need really (plus a faster + SAFER "all you need")!
(Simply because by using a custom HOSTS file, you can:
----
1.) Blockout known malicious websites & servers (like "botnet 'C&C' servers" for example) - which results in better security online
2.) You can blockout banner ads (these too have been found many times the past few years being exploited by malware makers & hacker/cracker types) - resulting in more SPEED and SECURITY online (especially nowadays).
3.) You can 'hardcode in' your favorite website into a custom HOSTS file as well (making for faster domainname/hostname resolutions to IP addresses, vs. calling out to a potentially-possibly compromised or downed DNS server) - resulting in more speed (sometimes this changes though, rarely, but it's only a matter of "ping'ing" the hostname/domainname to get the IP address again, & then, using a texteditor like notepad.exe to amend any fav. sites of yours that may have changed their hosting provider & thus, their IP Address, to fix that (happens only rarely though))??
----
What more do you need???
(And, as far as OpenDNS goes, iirc, they worked DIRECTLY WITH Mr. Dan Kaminsky to shore up their servers' defenses vs. the potential vulnerability that he found known as the "Kaminsky bug" & they WERE thus, the 1st to fix it (or even remedy it) on their end, as far as DNS server sites go, no less...
APK
P.S.=> I liked this benchmark a fellow here did, of OpenDNS, vs. GOOGLE DNS (too bad he didn't have "ScrubIT DNS" servers in there too though) -> http://bramp.net/blog/google-dns-benchmarked & it appears that OpenDNS is still the "speed champ" as well as being very Very VERY diligent when it came time to prep & shore up their defenses vs. the Kaminsky bug (they worked directly w/ Mr. K. on it, in fact, iirc)... apk
If you want to be safe and secure and keep your privacy, DON'T USE A NETWORKED COMPUTER!
Don't you realize what DARPA created the Internet for...?
If google has the DNS then Why doesn't google return the text-url when they could just return the numerical IP address in the link directly? That way you could skip the DNS step entirely. FOr sites you visit a lot they are probably already cached so a large fraction of uncached links come from google searches so this optimization might matter and it certainly would make google searches seem faster
Some drink at the fountain of knowledge. Others just gargle.