Slashdot Mirror
Chinese DNS Tampering a Real Threat To Outsiders
Trailrunner7 writes "China has long used the Internet's Domain Name Service to censor Web sites and information that the ruling Communist Party deems threatening. But now security experts warn that the government's censorship is in danger of spilling over China's borders, suppressing the ability of those living outside of China to find information online. An estimated 57% of all networks on Earth passed DNS requests through a Chinese DNS rootserver at some point in 2010, according to data from security firm Renesys. Tampering by the Communist Party there poses a danger to Internet security and freedom. In fact, DNS tampering may be a bigger threat than techniques like BGP (Border Gateway Protocol) hijacking, which is believed to be responsible for an unexpected shift in Internet routing in April that has recently been the subject of mainstream media reports in the US. There is already evidence that China's efforts to tamper with DNS have bled outside the country's borders. The same report to Congress from the US-China Economic and Security Review Commission that called attention to the BGP hijacking incident from April, 2010 also mentions a March, 2010 incident in which Internet users in the US and Chile attempted to connect to social networking websites banned by the Chinese government. However, their DNS requests were handled by a Beijing-based Domain Name Server, which responded with incorrect DNS information that directed the surfers to incorrect servers, the report says."
So, is it better to have China fucking around with the internet, or the US?
Quite frankly, I don't think either of them should be able to do it.
Fuck the both of them.
...DNS routes you! Oh, wait...
"I hear there's rumors on the Internets that we're going to have a draft."
He knows something we don't? Hmmmm
Life is not for the lazy.
I understand the need for mass replication of the DNS root servers and appreciate both the cultural and technical needs to spread them fairly evenly throughout the world but is it really necessary for China to replicate F, I and J at the root level? Would performance and the world perception of a US controlled internet really suffer if China was denied access to the root level? Let them replicate all 13 for their internal use but remove any server's root status if the server is hosted in China... Maybe I'm missing something here but is this not a reasonable stance on preventing this type of collateral damage?
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
DNSSEC. Get on it.
SIG: HUP
Isn't this a more deserving target than the US? Oh wait, they would immediate assassinate you if you leaked any of their information. Better keep going after the guys who don't fight back.
u.s. just grabbed 12 domain names, on the whim of some private interests inside usa. not only that they dropped an 'for other purposes' clause, in the bill/whatever that is going to allow them to do more.
'for other purposes'. you can even put 'daydreaming' in it, and legally grap domains that help people daydream.
Read radical news here
The United States government has already stolen domain names without due process. They don't even have jurisdiction over some of them.
http://yro.slashdot.org/story/10/11/27/1910232/DHS-Seizes-75-Domain-Names
At what point are we going to get sick enough of this garbage to just completely segregate China from the rest of the internet?
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
China almost looks free compared to the nazi regime USA is trying to have on the web, randomly yanking dominas(70+ recently) because american business interests were supposedly suffering. ..
Why do we have it then? AFAIK root zone was signed in May, so just don't send those super secret root zone KSKs to red commies and every validating resolver is safe!
Hooray for advanced protocol beating the red threat back!
So do we need a new way of describing DNS servers ?
We also probably also need a new way of describing DNS entries so you can tell the difference between an actual DNS for a site and a DNS for an edge caching site.
... I use the fantastic, free OpenDNS, and I have set resolv.conf to ns1.opendns.ch and ns2.opendns.ch years ago... crap! John, tear the wire from the wall, fast!
Just this past week the US government seized 75+ domains without any notice. Is this any different?
Since Chinese control 3 of the root DNS servers, I bet they are given the root zone KSKs.. and with them, you can spoof any record.
If only you could mod servers up or down, giving them some sort of reputation history. The your OS could determine a trusted anchor based on a server's "karma" and your requirements*. A system parallel to DNSSEC for apportioning, updating, and validating trust.
* yeah, I'm borrowing Slashdot terminology. But what the heck, it kind of works.
The world is made by those who show up for the job.
I know of folks working currently on secure BGP. I would imagine that's part of the solution.
Matt
(tl;dr version)
Big Threat Internet Security
China censor Web sites and information ruling Communist Party threatening security experts warn government's censorship danger spilling China's suppressing China Chinese Tampering Communist Party danger security and freedom tampering bigger threat hijacking unexpected China's tamper bled
U.S.-China Economic and Security Review Commission hijacking incident incident.
(And when I count to three you will awaken and be VERY AFRAID).
"Kill 'em all and let Root sort 'em out"
To Comcast?
http://news.cnet.com/8301-1023_3-20023949-93.html
Because I can damn well tell you that spilled over into other New England area networks, including the SAVVIS and Cogent networks in Boston area. Comcast says their DNS system failed, so how the fuck does a DNS attack knock out all the peering/routing/IP transport up there?
That whole thing smells bad, and I wonder if anyone knows the truth about wtf happened.
Not only that, but they intercept requests made to external DNSs as well - altering the results before arriving at your PC in China.
The only problem with that is when IPs change. For major sites, it doesn't happen often, but when it does it may toss you through a loop.
You might find it easier (and more efficient) to just build yourself a caching nameserver and set the TTLs high (hell you can do this on the workstation itself). Couple this with your existing method if you wish, there's no reason they can't work together.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
NOO!!!
I don't want some red china man stealing all my porn!
They might start Blurring it on the fly!!!
I just don't get what APK's deal is. He is clearly ignorant/misinformed and surely knows better...but I don't think I have ever seen a more dedicated troll than WillyonWheels. I mean..., he has been posting this same shit for years now, slightly customizing it for each story. It must be nice to have that much free time.
If you ignore ACs because they are anonymous - you're an idiot.
Wouldn't whitelisting known good IPs of frequent internet destinations within your hosts.conf (or equivalent) file provide at least moderate protection against IP hijacking?
Here I am, here I remain.
..for providing the technology that makes it possible to censor, track, and imprison.
In the USA, DNS needs to be woven into the first amendment as one of those things the government shall not fuck with, but I doubt the Roberts court will see it that way.
Why would they be given the keys? Surely they'd just be given the signed root zone file - it's not like it changes very often.
I am TheRaven on Soylent News
Someone's already said this too, but it seems obvious. Don't trust the Politburo. Simple. Don't trust a root server run by the Politburo. Then implement DNSSec. :)
Actually, no, the Root server operators do not need access to the private key used for key-signing. They only get a copy of the root zones, all signed ahead of time.
DNSSEC would solve this from a mis-information stand-point. It doesn't stop it from a DoS attack (just not answering, or even answering with bogus DNSSEC replies, which the DNS resolver will discard, but the end result is that you don't get your query answered).
Looks to m like a bad mod was corrected in 3.5 seconds. I didn't like Bush and I don't care much for Obama, but comparing them to Godwin's Ghosts is indeed flamebait.
Had he omitted that last line, it would have been interesting.
Free Martian Whores!
Tell me, why is it still possible for private parties to change things like this on a whim?
There needs to be a system where if the domain record returned from a dns server differs from the ones returned by say 4 others is different, it is discarded and the record returned by the 4 dns servers is used.
The root zone is distributed already signed to everybody. It is signed using special hardware in the US. Look up on the key signing cerimony to see the details.
a hosts file in a git distributed repo would be a nice idea for small organizations, provides a way to safely add/update entries.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
Since when are you obligated to use the Chinese root servers? And have you heard of DNSSEC? This is really just an issue of lazy admins. Same story with the root SSL certificates browsers ship with that include a lot of questionable organizations and governments. You are free to remove them, and no, it's not hard. The BGP hijack was no different. Carriers that have their shit organized have their filters configured and would not participate in the hijack.
difference ? chinese pretend to be abc com for their own aims, usa 'legally' grabs domains pretending to anyone worldwide, for their own aims. not to mention that, it makes the law that legalizes it.
Read radical news here
Tell me, why is it still possible for private parties to change things like this on a whim?
Uh, this isn't a 'private party', it's the Chinese government. DNS generally worked fine when it was controlled by 'private parties' and governments weren't meddling with it.
De-root is a useless measure. You don't trust China, someone else doesn't trust some other country hosting a root. DNSSec is the only acceptable solution currently available.
Also it's a little naive to think that Chinese cyberspace ends at it's physical borders. China's telco's have controlling stakes in many foreign communications companies as well. Not to mention lots of western ISP's are installing Huawai equipment, etc, etc.
Nice idea, but this doesn't help one bit if the censorship is done close to home. E.g. on "my" network I intercept DNS and have my name server send the reply. It doesn't matter if the users are talking to Google DNS, OpenDNS or some other service, it's always my DNS server that replies. DNS is extremely easy to intercept and spoof.
If you were found to be tampering with DNS, at the very least you'd have your internet service cut off, at worst you'd be arrested. The equivalent of "arresting" China would be called "World War III" and that's not going to happen (yet). We can, however, cut them off from the rest of the internet, can't we? Why haven't we? They refuse to behave, they don't own the internet (nobody does and everybody does, really), they don't have the right to do this. Cut them off until they learn to behave. Besides, to hear them talk, they'd probably prefer being cut off from the rest of the world so they can literally force their citizens to use only the sites the State wants them to.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Or they could just install a DNS caching server, it's not that hard. And besides the static hosts information, it would also share the DNS cache between all the clients, so if two of them accessed the same sites, it would be faster for the second client.
Debian comes with a few an aptitude install away.
Dilbert RSS feed
Root servers point to top-level domains. com, net, org, cn, us, uk... these would all have their own keys. China would only have access to one of those. As pointed out by others, the roots are pre-signed and just passed around for mirroring.
This doesn't prevent China from doing various nuisance activities such as replying with unresolvable, bogus unsigned answers, or bogus answers with wrong signers. That said, you'd at least have some level of verification available that a DNSSEC signed answer is appropriate, and you could ignore anything but.
SIG: HUP
If only you could mod servers up or down, giving them some sort of reputation history. The your OS could determine a trusted anchor based on a server's "karma" and your requirements*. A system parallel to DNSSEC for apportioning, updating, and validating trust.
Doesn't china have like, 1.2 billion people? If all the people in china mod up the Chinese DNS servers, and a the people in the US mod them down, I'm pretty sure they will still have a pretty good score...
HA! I just wasted some of your bandwidth with a frivolous sig!
Hmmm...
The general public:
"What's net neutrality? Meh, I don't care... WAIT, The Communist Party can censor and limit the information I receive?? BLASPHEMY. MAKE THE INTERNET FREE AND UNTAINTED BY CENSORSHIP!! RALLY RALLY RALLY!"
Ha. Slashdot: 1, Stupids: 0. ;)
I use dnsmasq myself often. I thought that people in organizations that fear government censorship are better with a hosts file on each computer than with a number of dns caches. The response can still be spoofed or the servers DoSed. Git can do signed commits and updates over ssh.
Also one could exploit virtual hosting configuration and gave a server that returns normal content if accessed through its normal domain, and special content if accessed through an entry in the hosts file (good against casual surfers and bots, useless against a determined attack)
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
Easy to remember
Non-Linux Penguins ?
Since Chinese control 3 of the root DNS servers, I bet they are given the root zone KSKs.. and with them, you can spoof any record.
Let me see...1.5 billion Chinese or the rest of the planet. Who would you not want to piss off?
The mind conceives, the body achieves, the spirit manifests.
I've had so many DNS problems in Asia (not China) and 8.8.8.8 solved them all. It was such a problem while I was there that I'd log into any default password routers in the hotels I stayed at and change their configs to that.
On top of that, since China is responsible for hacking Google earlier this year, Google will be taking special care to make sure their services will be protected from future attacks, and thus will likely fortify their DNS against root hijacking.
I was thinking of a DNS server in-LAN, not geographically distributed. In that case, I agree that a hosts file is more robust.
Dilbert RSS feed
The fact that for a few minutes all packets were being rerouted to china and then sent back to its final destination means a good packet sniffer will give you lots of info, as well, the government now has some pretty big super computers at their disposal, as well as being the first to show ASH1 was able to be broken....it all adds up.
Simple solution is to switch to 3rd party root servers like the Telecomix ones: http://dns.telecomix.org/
Kid, you have no idea what you're talking about. Stop posting a link to this post behind every post I make...,really, do you have nothing better to do?
You are strongly misinformed on several points. I can't be bothered to respond to you, (i.e. feed the troll) because I don't think it would be worth my time. You're obsessed, and not interested in rational discussion. Please, stop following me.
If you ignore ACs because they are anonymous - you're an idiot.
If you want me to addres you properly, then I want you to answer some questions.
If you have the courtesy to answer these questions, then I will address your main points as you ask.
If you ignore ACs because they are anonymous - you're an idiot.
Given your trollish behavior, i.e. stalking and insulting, you are clearly a troll. (note, that is also not an ad hominem attack). Given the way you obsessively stalk people, redundantly quote information and your strange use of quotes, I would say you also have some serious issues.
Computing just isn't your field kiddo, but I do hope you get the help you need. I won't be replying to you further until you answer my original questions in a polite manner.
If you ignore ACs because they are anonymous - you're an idiot.
Also, let me explain why I believe you misconstrue the 3 things you keep relying on for proof.
If you ignore ACs because they are anonymous - you're an idiot.
LMAO, wtf? Look at my initials, & look here then (as to academia, where I was a letter winner for a national champ in lacrosse, & also a graduate with a B.S. degree in the sciences):
http://lemoynedolphins.com/sports/mlax/history/mlaxletterwinners
I can not see any name on that list that matches the initials APK. If I don't know your name, then I can not verify anything you say, regardless of who you give me as a reference.
If you ignore ACs because they are anonymous - you're an idiot.
I give up...you really don't have any idea what you're talking about, and that joke a reply just shows it. I replied in good faith...and get religious shit in response. Best o luck dude. You're an idiot. (note, not an ad hominem, not dismissing you reply because I consider you an idiot, calling you an idiot as a consequence).
If you ignore ACs because they are anonymous - you're an idiot.
OK, Alex Kowalski. Awesome.
Funny when I search your name of Google, I find absolutely nothing of prominence. Maybe in the next life, kid.
If you ignore ACs because they are anonymous - you're an idiot.
Actually, digging a bit further, and eliminate all the other people with your name (musicians, reporters, AIDS societies fellows etc), I find you on several forums, where you have been banned. Makes sense that you would come to the last refuge on the internet where you can't get banned. You have helped me cement your status as an ignorant troll who lies about his/her own accomplishments. Good job kiddo.
If you ignore ACs because they are anonymous - you're an idiot.
OK, final post and no more googling. For anyone sad enough to be reading this, this post discredits APK basically completely. http://tech.slashdot.org/comments.pl?sid=1300193&cid=28673669
If you ignore ACs because they are anonymous - you're an idiot.