Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
2

I have my android device rooted, and only one RootTool app (Which is fairly popular and seems trust worthy to me, and which I use to tweak the phone) with root access. And I remember correctly setting the DNS settings to OpenDNS. While sorting out a network issue, Checked My DNS settings , and they were modified.

It turned out that a Video player app caused this change, along with some wierd advertisement in notification bar. After uninstalling that app, I found the market littered with similarly named video player apps, all claimed no root access , but access to device settings.

Two questions:

  1. Is DNS really an ordinary android setting ? I doesn't appears in settings menu. Can any app without root access this ?
  2. How dangerous is your address look-up pointed to an unknown server ?
share|improve this question
Hi wingman, welcome to IT Security. I think you should split this into two questions - one specifically about the Android root question, and the 2nd about the more general DNS interception question. You'll get better, more focused answers that way. – AviD♦ Oct 31 '12 at 11:31
Come to think of it, I'm pretty sure the 2nd one about DNS has been answered here a couple of times... can't look it up right now, but look around in the dns tag. – AviD♦ Oct 31 '12 at 11:33
Could you please name the video player app so we know which one not to use? – ewanm89 Oct 31 '12 at 11:52
@ewanm89 Don't remember exact name, Easy Video player or new Video player. The thing I remember was a flower like blueish icon. Now I stick to apps with sufficient rep in market. There might be good apps unknown down the list, but then, its a dangerous area too. – User117 Oct 31 '12 at 11:59

2 Answers

up vote 3 down vote accepted

It is actually possible to set your DNS servers in the phone's UI, by choosing a static IP in the advanced network connections settings. According to a question on StackOverflow, these settings can be programmatically altered as long as the WRITE_SETTINGS permission is set, using the following code:

android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_USE_STATIC_IP, "0");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_DNS1, "192.168.0.2");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_DNS2, "192.168.0.3");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_GATEWAY, "192.168.0.1");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_NETMASK, "255.255.255.0");
android.provider.Settings.System.putString(getContentResolver(), android.provider.Settings.System.WIFI_STATIC_IP, "1");

If you have USB Debugging enabled, the settings can also be changed by software on your PC, without any permission requirements or user interaction.

Onto the second part of your question: yes, this is most definitely a security concern. If an app sets your DNS server to a rogue server, it can redirect traffic to any IP address it wishes, facilitating a man-in-the-middle attack. Combined with tools like BeEF, sslstrip and sslsniff, it's almost trivial to completely spoof your browsing experience.

share|improve this answer
1  
Thank you. Now I have a hard time trusting any app that uses these permissions. Google should do something about this. – User117 Oct 31 '12 at 11:34
@Polynomial This code is not working for Android OS ver.3 & above. Can you help us for that too. – Harpreet Feb 25 at 12:08
@Harpreet Nope, sorry, you'll have to go ask on StackOverflow for that one since it's a code problem. I just pulled that code from another source; I'm not an android dev. – Polynomial Feb 25 at 13:00
@Polynomial: Ok, thanks. :) – Harpreet Feb 26 at 5:44
These settings were deprecated in API 17, the current version of AOSP jellybean, and now setting the DNS for wifi has to be set through the wifiManager so there would be a slightly different permission required, but there is also the potential of a malicious app modifying these settings through an app has the correct permissions and exposes publicly accessible components that don't check the permissions of the caller or require permissions.(developer.android.com/reference/android/provider/…) – Quentin Swain Apr 29 at 13:40
up vote 0 down vote

This code won't work indeed on Android 3.0 and above unless app is installed in /system/app partition. Those are now protected settings.

Also it doesn't answer the question of setting DNS when on mobile data instead of WiFi.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.